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A likely impossibility is always preferable to an unconvincing possibility 

— Aristotle 



Preface 

This text represents an extensive expansion and revision, both in scope and content, 
of the earlier work entitled “Militan Cryptanalysis, Part II by William F Friedman 
This expansion and revision, as indicated in the preface of the first volume of this present 
series, was necessitated by the considerable advancement made m the art since the publica- 
tion of the original version 

The first 9 chapters of this text are being published m this interim edition to make it 
readily available for use in < ryptologic training programs of the National Security Agency 
and of the Service Crxplologic Agencies The last 5 chapters and the appendices will be 
issued m an interim version m the near future, after which the entire text will be formally 
published in one volume 

— L D C 
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CHAPTER I 

INTRODUCTORY REMARKS 



Paragraph 



General 1 

The essential difference between monoalphabetic and polyalphabetic substitution 2 

Example of polyalphabetic substitution 3 

Primary classification of polyalphabetic systems 4 

Primary classification of periodic systems 5 

Sequence of study of polyalphabetic systems 6 



1. General. — a . This text constitutes the second in the series of 
six basic texts on the science of c ryptana lyt ic s as applied to military 
communications In general, without regard to the particular Service in- 
volved (i.e., army, navy, or air force traffic). 

b. It is assumed that the reader has studied Military Cryptanalytlcs , 
Part T , and is familiar with the cryptologic concepts , princ iples , and 
techniques of solution of the various cryptosystems treated in that text, 
this background is a necessary prerequisite to the understanding of the 
principles expounded in the present text. 

c. It is taken for granted that the student has acquired a background 
of generalized cryptologic terminology from the study of the first text and 
its accompanying glossary. The new terms which appear in this text are 
usually defined upon their first occurrence; these terms, as well as others 
Which are necessary for cross-reference, are included in the glossary to 
this volume (Appendix l) . 

d. As has been already indicated, each text has its accompanying 
course of problems in cryptanalysis, so that the student may have the 
opportunity of applying the principles learned to practical examples, and 
In so doing develop skill in the analysis of the types of cryptosystems 
treated in this text. The problems which pertain to this text constitute 
Appendix 10. 

e. As was the case in the preceding text, this present volume is 
written from the standpoint that the reader has had a minimum of mathema- 
tical background, not beyond elementary algebra; the authors have endeavored 
to enhance this background gradually and progressively, to enable the student 
to be better versed in the mathematical techniques and applications in the 
art of cryptanalysis . As before , footnotes are used to give additional 
general Information about the subject being treated, or to amplify mathema- 
tical principles in details which may be beyond the average reader; therefore 
certain footnotes may be passed over by the student. The next text, 

Military Cryptanalytlcs , Part III , will contain a comprehensive treatment of 
the fundamentals of crypto mathematics , and will of necessity recapitulate 
the points of mathematical observations made in the first two texts . 
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f . The next paragraph will bridge the gap between the basic concept 
of the systems treated in the previous text and the principles to be 
introduced in this present volume. 

2. The essential difference between nonoalphabet lc and polya lphabetlc 
substitution .' — a . tn the substitution methods tnus Tar discussed it has 
Wen pointed out that their basic feature is that of aonoa lphabetlc ity . 

From the cryptanalytlc standpoint, neither the nature of the cipher symbols, 
nor their method of production Is an essential feature, although these may 
be differentiating characteristics from the cryptographic standpoint. It 
is true that In the cases of monoalphabet lc substitution with variants and 
in syllabary squares and code charts , there is a departure , more or less 
considerable, from strict monoalphabet ic ity. In some of the cases of variant 
systems indeed, there may be available two or more wholly independent sets 
of equivalents, which, moreover, may even be arranged in the form of com- 
pletely separate alphabets . Thus , while a loose terminology might permit 
one to designate such systems as polyalphabet ic, it is better to reserve 
this nomenclature for those cases wherein polya lphabetlc ity is the essence 
of the method, specifically Introduced with the purpose of imparting a 
positional variation in the substitutive equivalents for plaintext letters, 
in accordance with some rule directly or indirectly connected with the 
absolute positions the plaintext letters occupy in the message. This point 
calls for amplification. 

b. In monoalphabet ic substitution with variants the object of having 
different or multiple equivalents is to suppress, so far as possible by 
simple methods, the characteristic frequencies of the individual letters 
occurring in plain text. As has been noted, it is by means of these 
characteristic frequencies that the cipher equivalents can usually be 
identified. In these systems the varying equivalents for plaintext letters 
are subject to the free choice and caprice of the enciphering clerk; if be 
is careful and conscientious In the work, he will really make use of all 
the different equivalents afforded by the system; but if he is slip-shod 
and hurried in his work he will use the same equivalents repeatedly rather 
than take pains and time to refer to the charts , tables , or diagrams to find 
the variants. Moreover, and this is a crucial point, even if the Individual 
enciphering clerks are extremely careful, when many of them employ the same 
system It is entirely impossible to Insure a complete diversity in the 
encipherments 1 produced by two or more clerks working at different message 
centers . The result is inevitably to produce plenty of repetitions and 
near-repetitions or Isologous sequences in the texts emanating from several 
stations , and when texts such as these are all available for study they are 
open to solution, by a comparison of their similarities and differences. 



1 1 1 must be noticed however, that a complete diversity of enciphering is sometimes not necessarily 
an optimum desideratum from the standpoint of cryptosecurity, a complete diversity of encipherments, m 
the case of isologs, would lay bare all the elements of a variant system See in this connection the example 
given in subpar 62b m Military Cryptanalytics, Part I 
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c. Is true polyalphabet ic systems , os the other hand, there is 
established a rather definite procedure which automatically determines 
the shifts or changes in equivalents or in the manner in which they are 
Introduced, so that these changes are beyond the momentary whim or choice 
of the enciphering clerk. When the method of shifting or changing the 
equivalents is scientifically sound and sufficiently complex, the research 
necessary to establish the values of the cipher characters is such more 
prolonged and difficult than is the case even in complicated monoalpha - 
betlc substitution with variants, as will later be seen. These are the 
objects of true polyalphabetic substitution systems . The number of such 
systems la quite large, and it will be possible to describe in detail 

the cryptanalysis of only a few of the more common or typical examples 
of methods encountered in practical military conmnanications . 

d. The three methods, (l) single -equivalent monoalphabetic substi- 
tution, (2) monoalphabetic substitution with variants, and (3) true 
polyalphabetic substitution, show the following relationships as regards 
the equivalency between plaintext and ciphertext units: 

A. In method (l), there is a set of 26 symbols, a plaintext letter 
is always represented by one and only one of these symbols; conversely, a 
symbol always represents the same plaintext letter. The equivalence 
between the plaintext and the cipher letters is constant in both encipher- 
ment and decipherment. 

B . In method (2) , there is a set of n symbols , where n may be any 
number greater than 26 and often is a multiple of that number; a plain- 
text letter may be represented by 1, 2, 3, . . . different symbols; con- 
versely, a symbol always represents the same plaintext letter, the same 
as is the case in method (l) . The equivalence between the plaintext 
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and the cipher letters Is variable in encipherment but constant In 
decipherment. 2 

C. In method (3) , there is as in the first method, a set of 26 
symbols ; a plaintext letter may be represented by 1, 2 , 3, . . .26 
different symbols; conversely, a symbol may represent 1, 2 , 3> • • .26 
different plaintext letters, depending upon the system and the specific 
key. The equivalence between the plaintext and the cipher letters is 
variable In both encipherment and decipherment. 



2 As has been pointed out in the previous text, there Is a monoalphabeuc method m which the 
inverse result obtains, the correspondence being constant in encipherment but variable m decipherment, 
this is a method not found in the usual books on cryptography but m an essay on that subject by Edgar 
Allan Poe entitled, in some editions of his works, A few words on secret writing and mother 
editions Cryptography The method is to draw up an enciphering alphabet such as the following 
(using Poe's example) 

Plain ABCDEFGHIJKLMHOPQRSTUVWXYZ 

Cipher... SUAVITERIUMODOFORTITERIHRE 



In such an alphabet because of repetitions in the cipher component, the plaintext equivalents are 
subject to a considerable degree of variability as will be seen m the deciphering alphabet 



Cipher . . . . 
Plain 



ABCDEFQHIJKLMIOPQRSTUVWXYZ, 

C HO 0 E KJL E AHO 

U I X If Q R 

Z S PVT 

W Y 



This type of variability gives rise to ambiguities in deci pherment A cipher group such as TIE C 
would yield such plaintext sequences as SEC, FIG, TEU, REU, etc , which could be read onlyby 
context No system of such a character would be practical for serious usage For a further dis- 
cussion of this type of cipher alphabet see Friedman William F , Edgar Allan Poe, Cryptographer, 
Signal Corps Bulletins Nos 97 (July-Sept ) and 98 (Oct -Dec ), 1937 
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3. Example of polya lphabetic substitution. — a. A simple example 
may be used to illustrate what is meant by true polyalphabet ic substi- 
tution . Suppose that tvo correspondents agree upon a numerical key, for 
example , 74030274 , each digit of vhlch means that the plaintext letter to 
which the digit applies as a key number is to be replaced by the letter 
that stands a corresponding number of places to the right of it in the 
normal alphabet . For example , if Rp is to be enciphered by key number 7 
it is to be replaced by Y c . The numerical key is written over the letters 
of the plain text, letter for letter, and is repeated until the whole text 
is covered . 3 Let the message be REINFORCEMENTS BEING BUSHED. The 
encipherment of this message is shown in Fig. 1, below. For convenience 
in counting forward (to the right) to find cipher equivalents, a normal 
alphabet is given at the top of the figure. To decipher such a crypto- 



Bormal alphabet: ABCDEFGHIJTa^INOPQRSTUVWXIZ 



Key: 

Plain text: 
Cipher text: 



74030 27474 03027 47403 02747 
RE INF ORCEM EHTSB EXHGR USHED 
YIIQF QTCLQ EQTtJI IPRGU UUOUC 

Figure 1. 



gram, the clerk writes the numerical key over the cipher letters and 
then counts backward (l.e., to the left) in the normal alphabet as many 
places as indicated by the key number standing over each letter. 

b. Instead of writing the key over and over again in order to cover 
the plain text completely, the text may be written in sets of letters 
corresponding in length to the length of the key. Thus the text may be 
written underneath a single appearance of the key in successive short 
horizontal lines leaving space between the lines for the insertion of 
cipher equivalents, as shown in Fig. 2. Instead of enciphering the letters 
by individual repeated countings, two strips bearing normal alphabets may 

74030274 

REINFORC 

EMENTSBE 

INGRUSHE 

D 



Figure 2. 
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This system being described is known in cryptologic literature as the Gronsfeld cipher 
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be juxtaposed In the proper relative positions to encipher a whole 
column of letters at one setting of the strips . Thus for the first 
column , with the key number 7, the strips are juxtaposed so that the 
first letter in the column, viz., Rp (which is to be represented by 
the seventh letter to the right of it, and is therefore to be 
enciphered by Yc of the lower strip) Is directly above Y c , as follows: 

Plain: ABCDEFGHIJKIMR0PQR3TDVWXYZ 

Cipher: ABCDEFGHIJKLMNOPQRSTOVWXYZAHTDEFGEIJKIJaroPQRSTOVWXYZ 

The equivalents for the rest of the letters of the first column may 
now be written under their respective plaintext letters, reference 
being made to the enciphering alphabet to see what the cipher letters 
should be: Ep ® Lc; Ip * Pc» and Dp * Kc • For the second column, the 
two strips are juxtaposed as follows: 

Plain: ABCDEFGEIJKIMROFQRSTUVVYYZ 

Cipher: ABCDEFGHIJKIiWOPQRSTDVWXYZABCDEFOHIJTaJfflOPQRSTUVWm 

The cipher equivalents for the second column are: Ep = Ic ; Mp = Qc ; 
and Up = Rc . The process is continued in this manner until all the 
columns have been enciphered as shown in the diagram below: 

7403027 ^ 

REIHFORC 

YIIQFQYC 

EMEHTSBE 

LQEQTUII 

I5GRUSHE 
PRGUUUO I 

D 

K 

The cipher text is then transcribed in five -letter groups for trans- 
mission, viz., YIIQF QYGLQ EQTUI IPRGU UUOIK. This systematized pro- 
cedure has the merit of being faster, less laborious, and less liable 
to error than the method shown in subpar. 3a. 

4. Primary classification of polyalphabetic systems . --a. A primary 
classification of polyalphabetic systems into two rather distinct types 
may be made: (l) periodic systems and (2) aperiodic systems. When the 

enciphering process involves a cryptographic treatment which is repe- 
titive in character, and which results in the production of cyclic 
phenomena In the cryptographic text, the system is termed periodic . 
when the enciphering process is not of the type described in the fore- 
golng general terms, the system is termed apar iodic . The substitution 
in both cases Involves the use of two or more cipher alphabets. 
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b . The cyclic phenomena Inherent in a periodic system may be 
exhibited externally, in which case they are said to be patent , or they 
may not be exhibited externally, and must be uncovered by a preliminary 
step in the analysis in which case they are said to be latent . The 
periodicity may be quite definite in nature, and therefore determinable 
with mathematical exactitude allowing for no variability, in which case 
the periodicity is said to be fixed . In other instances the periodicity 
is more or less flexible m character and even though it may be determi- 
nable mathematically allowance must be made for a degree of variability 
subject to limits controlled by the specific system under investigation. 
The periodicity is in this case said to be flexible , or variable within 
limits . 

5. Primary classification of periodic systems . — a. Periodic poly- 
alphabet ic substitution systems may primarily De classified into two kinds: 

(1) Those in which only a few of a whole set of cipher alphabets are 
used in enciphering Individual messages, these alphabets being employed 
repeatedly in a fixed sequence throughout each message. Because it is 
usual to employ a secret word, phrase, or number as a key to determine 
the number identity, and sequence with which the cipher alphabets are 
employed, and this key is used over and over again in encipherment, this 
method is often called the repeating -key system , or the repeating -alphabet 
system . In this text the designation " repeat ing -key system" will be used. 4 

(2) Those in which all the cipher alphabets comprising the complete 
set for the system are employed one after the other successively in the 
encipherment of a message, and when the last alphabet of the series has 
been used, the encipherer begins over again with the first alphabet. This 
is commonly referred to as a progressive -alphabet system because the 
cipher alphabets are used in progression. 

6. Sequence of study of polyalphabet ic systems. — a. In the studies 
to be followed in connection with polyalphabet ic systems, the order in 
which the work will proceed conforms very closely to the classifications 
made in pars . 4 and 5 . Periodic polyalphabetic substitution ciphers will 
come first, because they are, as a rule, the simpler and because a thor- 
ough understanding of the principles of their analysis is prerequisite to 
a comprehension of how aperiodic systems are solved. But in the final 
analysis the solution of examples of both types rests upon the conversion 
or reduction of polya lphabeticity into monoalphabeticity. If this is 
possible, solution can always be achieved, granted there are sufficient 
data in the final monoalphabetic distributions to permit of solution by 
recourse to the ordinary principles of frequency. 



4 French terminology calls this the "double-key method”, but there is no logic in such nomenclature 
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b. First in the order of study of periodic systems vill come the 
analysis of repeating-key systems . Some of the more simple varieties 
vill he discussed in detail, vith examples. Subsequently, ciphers of 
progressive alphabet systems vill be discussed. There vill then follov 
a treatment of polyalphabetic bipartite systems , monome -diname systems 
vith cyclic additives , and periodic digraphic systems . Aperiodic systems 
vill be treated in detail in Military Cryptanalytics, Part III. 
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derivation . — a . The substitution processes in polyalphabetic methods 
involve the use of a plurality of cipher alphabets. The latter may be 
derived by various schemes , the exact nature of which determines the 
principal characteristics of the cipher alphabets and plays a very 
Important role in the preparation and solution of polyalphabet ic crypto- 
grams. For these reasons it is advisable, before proceeding to a 
discussion of the principles and methods of analysis, to point out these 
various types of cipher alphabets , show how they are produced, and how 
the method of their production or derivation may be made to yield important 
clues and shortcuts in analysis. 

b. A primary classification of cipher alphabets for polyalphabet ic 
substitution may be made into the two following types: 

(1) Independent or unrelated cipher alphabets. 

(2) Derived or interrelated cipher alphabets. 

c . Independent cipher alphabets may be disposed of in a very few 
words . They are merely separate and distinct alphabets showing no rela- 
tionship to one another in any way. They may be compiled by the various 
methods discussed in par. 39 o f Military Cryptanalytics , Part I . The 
solution of cryptograms written by means of such alphabets is rendered 
more difficult by reason of the absence of any relationship between the 
equivalents of one cipher alphabet and those of any of the other alphabets 
of the same cryptogram. On the other hand, from the point of view of 
practicability in their production and their handling in encrypting and 
decrypting, they present some difficulties which make them less favored 
by cryptographers than interrelated cipher alphabets . 

d. Derived or interrelated alphabets, as their name indicates, are 
most commonly produced by the interaction of two primary components , which 
when Juxtaposed at the various points of coincidence can be made to yield 
secondary alphabets. 
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8 . Primary components and secondary alphabets . — Two basic, slidable 
sequences or components of n characters each will yield n secondary 
alphabets. The components may be classified according to various schemes. 
For cryptanalytic purposes the following classification will be found 
useful: 

Case I. The primary components are both normal sequences . 

a. The sequences proceed in the same direction. (The secondary 
alphabets are direct standard alphabets.) (Pars. 20-22 .) 

b. The sequences proceed in opposite directions. (The secondary 
alphabets are reversed standard alphabets; they are also reciprocal cipher 
alphabets.) (Subpars. 201, 21g.) 

Case II. The primary components are not both normal sequences. 

a. The plain component is normal, the cipher component is a mixed 
sequence. (The secondary alphabets are mixed alphabets.) (Pars. 26-3$.) 

b. The plain component is a mixed sequence, the cipher component is 
normal. (The secondary alphabets are mixed alphabets.) (Par. 36 .) 

c. Both components are mixed sequences. 

1. Components are identical mixed sequences. 

(a) Sequences proceed in the same direction. (The secondary 
alphabets are mixed alphabets.) (Far. Ul.) 

(b) Sequences proceed in opposite directions. (The secondary 
alphabets are reciprocal mixed alphabets.) (Par. 55 .) 

2 . Components are different mixed sequences . (The secondary 
alphabets are mixed alphabets.) (Par. $6.) 

9. The use of key words to indicate number, Identity, and sequence 
of cipEer alphabets employed . — a . if reference is 5a&e to the two settings 
of alphabet strips in subpar. 3b, it will be noted that in the first 
setting, Ag « He, and in the second setting, A« • Ec« If the eight 
settings or the strips are studied it will be round that the letters which 
A- represents successively are H, E, A, D, A, C, H, and E, giving the word 
HEADACHE. These settings, when first presented in the foregoing descrip- 
tion, correspond merely to the numerical key 74030274, but this numerical 
key is also expressible in terms of letters, which when put together 
properly spell a word. This is only another way of showing that key words 
may be employed in this type of substitution as in those previously 
described. Key words of various lengths and composition may be used, 
consisting of single words, long phrases or sentences. In general, the 
longer the key the greater is the degree of cryptographic security. 
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b . The number of elements in the key — that is, that number of letters 
or figures composing it — determines the number of alphabets to be employed. 
The Identity of each element of the key, the specific letter or figure It 
happens to be, determines specifically vhich of a set of cipher alphabets 
pertaining to the whole system will be used. And the specific sequence 

or relative order of the elements of the key determines specifically the 
sequence with vhich the cipher alphabets are employed vlthin the encipher- 
ment. The total number of cipher alphabets pertaining to or composing the 
system may be limited or unlimited. When they are produced as a result of 
the sliding of two basic or primary alphabets against each other, the num- 
ber is limited to 26 in the English alphabet. 

c. A brief notation for indicating or designating a specific key 
letter is to suffix the subscript n k" to it, just as the subscripts n p" 
and "c" are suffixed to letters to indicate letters of the plain text or 
cipher text, respectively. When the key letter occurs in an equation, it 
can be enclosed vlthin parentheses to avoid ambiguity. Thus Bp(Dk) ■ Ec 
means that the plaintext letter B when enciphered by the key letter D (in 
a certain alphabet system) yields the cipher letter E. 

10 . C ipher disks . — a . In subpar. 3b, it vas noted that the separate 
alphabets employed in tbe~encipherment are produced by the use of only two 
strips of paper bearing the normal alphabet. Such strips are often referred 
to as sliding alphabets , because they can be shifted or slid against each 
other in any one of 26 points of contact or coincidence. Exactly the same 
results, so far as cipher equivalents are concerned, can be obtained by the 
use of other devices. First, there are the so-called cipher wheels or 
cipher disks in vhich an alphabet is written on the periphery of a rotating 
disk, the circumference of vhich is divided into 26 equal segments, and this 
disk is made to revolve concentrically upon a similar but slightly larger 
fixed disk . Fig. 3 shows the now obsolete U.S. Army Cipher Disk, vhich 
is of this simple type. Here the alphabetic sequences are printed on 
glossy celluloid, are permanent, and admit of no variation. The use of 
unglazed celluloid upon which blank segments appear would permit of writing 
letters and erasing them as often as desirable. Thus, quick and easy 
change of alphabets would be possible. 

b. The cipher alphabets produced by the cipher disk shown in the 
figure are merely reversed standard alphabets, the same as are produced 
by the use of sliding strips of paper , and by the use of certain tables 
which are discussed below. The method of employing the disk needs no 
discussion. It may serve in monoalphabet ic or polyalphabetic substitution 
with a key word or key number. 
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lo encipher a message the key letter or the first letter of the 
key word or phrase is set orposite 'a ’ Let us assume it 
to be i. The cipher letters to be written are those 
opposite the text letter when a on the circle is set 
opjiosite ‘ E' on the card For example send powder ’ 
would be written MARBPQIBAV " To use a key word 
or phrase each letter is used in turn to encipher one letter 
only \\ hen the last letter of the key word is used repeat 
until all letters of the message are enciphered Numbers 
when enciphered with the disk must be spelled out 



Figure 3. 

11. Square tables. — a. Tables known in the literature of cryptog- 
raphy under various names ~such as "Vigenere Square", "Vigenere Table", 
"Square Table" , "Pythagorean Table" , etc . , are often employed in poly- 
alphabetic substitution. All the results produced by their use can be 
duplicated by the employment of sliding alphabets or revolving disks. 

The modem form of the Vigenere Square is shown in Fig. 4. Such a square 
may be used m various ways, differing from one another in minor details. 
The most common method is to consider the top line of the table as con- 
taining the plaintext letters, the first column at the left as containing 
the key letters. Then each successive horizontal line contains the cipher 
equivalents for the plaintext sequence ABC...Z enciphered by the key letter 
which stands at its left in the first column. Thus, the cipher alphabet 
corresponding to key letter D is the sequence of letters in the fourth 
horizontal line under the plaintext line, where Ap ■ Dc, Bp * Ec, etc. It 
will be easy to remember, in using such a table, that the equivalent of 
a given plaintext letter, T p , for example, enciphered by a given key letter, 
0]^, lies at the intersection of the vertical column headed by T, and the 
horizontal row begun by 0. In this case Tp(Ok) * He. The same result 
will be found on referring to sliding, direct standard alphabets. 
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Figure 4. The Vlgenere Square 

b. Minor modifications of tbe Vigenere Square are encountered. If 
the top line is made a reversed normal sequence, leaving the interior of 
the table unchanged, or if the successive horizontal rovB are made to 
contain the reversed normal sequence, leaving the top rev (plain text) 
unchanged, then the results given by using the table are the same as 
those given by using the cipher disk shovn in Fig. 3* Again, the same 
general results can be obtained by using a set of alphabets in tabular 
form known under the names of Porta's Table and Napoleon's Table, which 
is shown in Fig . 5 • 
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ABCDEFGHIJKLM 
HOPQRSI P V W X Y Z 
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ABCDEFGHIJKLM 

PQ8STUVWXYZH0 



ABCDEFGHIJKLM 

QRSTUVWXYZHOP 



ABCDEFGHIJKLM 

STPVWXYZHOPQR 



ABCDEFGHIJKLM 

TUVWXYZHOPQRS 
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Figure 5. 

In this table the alphabets are all reciprocal, for example, Gp(Wfc) a Re, 
Rp(Wfc) « G c . Reciprocal alphabets when arranged In this form are sometimes 
called complementary alphabets . Hote that in each alphabet either of two 
letters may serve as key letter indifferently: Gp(Vfe) or Gp(Xk) ■ Rc . 

c. Another modification of the basic table, and one that enqployB 
numbers instead of letters as cipher equivalents is shown in Fig. 6. Since 
many more than 26 different equivalents are available (100 pairs of digits 
from 00 to 99 ), It is possible to Insert many plaintext elements in the top 
line of the table in addition to the 26 letters. For example, one could have 
the 10 digits, a few common double-letter combinations, such as DD, LL, HR, 
and SS; a few of the most frequently used digraphs, such as TH, ER, IN, or 
even such common syllables as EHT, IBS, and IOH. The table shown in Fig. 6 
was used by the Italian army in World War I , and was known as the 
"Cifrario mllltare tascabile" (Pocket military cipher). 
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Figure 6 
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12. Square tables employing mixed alphabets. — a. In the tableB thus 
far shown tne alphabets have been direct or reversed~~atandard sequences, 
hut just as mixed sequences may be vrltten upon sliding strips and re- 
volving disks, so can mixed alphabets appear in tabular form. The table 
shown in Fig. 7, based upon the keyword sequence derived from the word 
IEAVEHHORTE, is an example that is equivalent to the use of a strip 

Plain text 
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Figure 7. 

bearing that keyword sequence sliding against another strip bearing the 
normal alphabet. The usual method of using such a table is the same as 
that In the preceding cases . The only difference is that the key letters 
must now be sought in a mixed sequence, whereas in the preceding tables 
they were located in direct or reversed standard sequences . Example , 
using Fig. 7: C p (S k ) « Y c . 

b. Fig. 8 illustrates a case In which a mixed alphabet is sliding 
against itself. The usual method of employing such a table is exactly 
the same as that explained before . The only difference is that both the 
plaintext letters and the key letters must be looked for in mixed sequences 
Example, using Fig. 8: U p (R k ) = V c . 
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Figure 8. 

c. In employing sliding alphabets It is usual to set the key let- 
ter as located In the cipher component opposite the letter A as located 
in the plain component or the key letter as located in the cipher com- 
ponent may be set opposite the initial letter of the plain component. 

In all examples preceding that in Fig. 8, the key letter has been A. In 
Fig. 8, since the plain component is also a mixed sequence and its initial 
letter is Q, the sliding alphabets are set against each other so that the 
given key letter in the cipher component is opposite Q in the plain com- 
ponent . Thus , to duplicate the results given by the use of Fig . 8 in 
finding the value of Up(Rk ) > it is necessary to set the sliding strips in 
the following relative positions: 

Plain: QUESTI OEABLYC DFGHJKMPRVWXZ 

Cipher: QUESTIOHABLTCDFGEJKMPRVWXZQUESTIOIlABLICnFGHJXMPRVVXZ 

Here it is seen that Up(Rfc) = V c , which is identical with the result 
obtained from the use of the table. There are other ways of using the 
table, however, each having a correspondingly modified method of employing 
sliding strips in order to obtain identical results; these ways and methods 
will be discussed in the next paragraph . 
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d. In addition to cryptographic schemes in vhich there are cipher 
squares composed of slides of a basic sequence to produce the various 
alphabets, it is of course possible to have n unrelated, random-mixed 
alphabets (here n can be any number) used cyclically to encipher the 
letters of a message. Such a scheme cannot be reduced to two components , 
and therefore would require the alphabets written out in a matrix or in 
tabular form. For instance a system might incorporate 1,000 different 
mixed alphabets, numbered from 1-1,000, then alphabet 1 might be used to 
encipher the first letter of each message, alphabet 2 the second letters, 
etc. There are also cryptographic schemes in which certain alphabets out 
of a total are selected for enciphering a given message, the selection 
being governed by an indicator, or the date, or a similar convention. 

These systems will be discussed in greater detail in Chapter XI. 

13. Further remarks on primary components . — a. In preceding para- 
graphs it has been shown that the equivalents obtainable from the use of 
square tables may be duplicated by the use of revolving cipher disks or 
of sliding primary components It was also stated that there are various 
ways of employing such tables, disks, and sliding components. Crypto- 
graphically the results may be quite diverse from different methods of 
using such parapherna 1 ia , since the specific equivalents obtained from 
one method may be altogether different from those obtained from another 
method. But from the cryptanalytlc point of view the diversity referred 
to is of little significance; only in one or two cases does the specific 
method of employing these cryptographic instrumentalities have an important 
bearing upon the procedure in cryptanalysis. However, it is advisable 
that the student learn something about these different methods before 
proceeding with further work. 

b. There are, not two , but four letters involved in every case of 
finding equivalents by means of sliding primary components; furthermore, 
the determination of an equivalent for a given plaintext letter is re- 
presentable by two equations involving four elements , usually letters . 

Three of these letters are by this time well-known to and understood by 
the student, viz . , 0fc, 6p, and 0c • The fourth element or letter has been 
passed over without much comment, but cryptographically it is just as 
important a factor as the other three . Its function may best be indicated 
by noting what happens when two primary components are juxtaposed, for 
the purpose of finding equivalents. Suppose these components are the 
following sequences: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWNOX 

low suppose one is merely asked to find the equivalent of Pp when the key 
letter is K. Without further specification, the cipher equivalent cannot 
be stated; for it is necessary to know not only vhich K will be used as 
the key letter, the one in the component labeled (l) or the one in the 
component labeled (2), but also what letter the Kfc will be set against, in 
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order to juxtapose the two components. Most of the time, in the pre- 
ceding text, these tvo factors have been tacitly assumed to be fixed 
and veil understood: the Kfc is sought in the mixed, or cipher com- 

ponent, and this K is set against A in the normal, or plain component. 
Thus: 

Index Plain 

I t 

(1) Plain: ABCDEFGHIJIOIWOPQRSTOVWXIZ 

(2) Cipher: FBPIRCQZIGSEETDJUMKVAUniOXFBPTBCQZIGSEBT!DJl)MK!7AUnK)X 

Key Cipher 

With this setting, Pp « Z c . 

c . The letter A in this case may be termed the index letter , 
symbolized A^. The index letter constitutes the fourth element involved 
in the tvo equations applicable to the finding of equivalents by sliding 
components. The four elements are therefore these: 

(1) The key letter, 

(2) The index letter, ©i 

(3) The plaintext letter, Op 

(4) The cipher letter, 6 C 



The index letter is commonly the initial letter of the component; but 
this, too, is only a convention. It might be any letter of the sequence 
constituting the component, as agreed upon ‘by the correspondents. Hovever, 
in the subsequent discussion it vill be assumed that the index letter is 



, unless other- 



wise state 



d. In the foregoing case the enciphering equations are as follows: 

(I) K* ■ At; P p * Zc 

But there is nothing about the use of sliding components which excludes 
other methods of finding equivalents than that shown above. For instance, 
despite the labeling of the tvo components as shown above, there is nothing 
to prevent one from seeking the plaintext letter in the component labeled 
(2), that is, the cipher component, and taking as its cipher equivalent the 
letter opposite it in the other component labeled (l). Thus: 

Index Cipher 

l ; 

(1) ABCDEFGHIJKLMBOPQRSTUVWXYZ 

(2) FBPIPC QZIGSEHTDJUMKV AIWN0XFBPYR3 QZIGSEHTDJUMKV AIWNOX 

t t 

Key Plain 



Thus : 



(II) K k • Aj ; P p = K c 
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e. Since equations (i) and (II) yield different resultants, even 
with the same index, key, and plaintext letters, it is obvious that an 
accurate formula to cover a specific pair of enciphering equations must 
include data shewing in What component each of the four letters comprising 
the equations is located. Thus, equations (i) and (II) should read: 

(I) Kfc in component (2) = Aj in component (l); Pp in component (l) 

• Zc in component (2). 

(II) Kjj in component (2) ■ in component (l); Pp in component (2) 

■ Kg in component (l) . 

For the sake of brevity, the following notations will be used: 

^ \/2 * A i/l J P p/l “ Z e/2 

(2) K k / S a Ai/xJ Pp/ 2 ■ Kq/i 

f . Employing two sliding components and the four letters entering 
into an enciphering equation, there are, in all, twelve different resultants 
possible far the same set of components and the same set of four basic ele- 
ments . These twelve differences in resultants arise from a set of twelve 
different enciphering conditions, 1 as set forth below (the notation adopted 
in subpar. e is used): 



(1) 


®k/2 


* 6 i/li 


G P/1 


3 ®c/2 


(7) 


®k/2 


II 

H 

*• 


®i/2 


3 ®c/l 


(2) 


®k/2 


* ®i/l» 


®p/2 


3 ®c/l 


(8) 


®k/2 


3 ®c/U 


®i/2 


3 ®p/l 


(3) 


®k/l 


- e i/2 J 


®P/1 


3 ®c/2 


(9) 


®k/l 


- ® p / 2 ; 


®i/l 


3 ®c/2 


(*> 


®k/l 




®p/2 


3 ®c/l 


(10) 


®k/l 


3 ®c/2 J 


®i/l 


* ®p/2 


(5) 


®k/2 


“ 6 P/1 J 


®i/l 


3 ®c/2 


(11) 


®k/l 


3 ®p/2» 


®i/2 


3 «c/l 


(6) 


®k/2 


* e c/li 


®i/l 


®p/2 


(12) 


®k/l 


3 ®c/2* 


®i/2 


3 ®p/i 



g. The twelve resultants obtainable from Juxtaposing sliding com- 
ponents as indicated under the preceding subparagraph may also be obtained 
either from one square table, in which case twelve different methods of 
finding equivalents must be applied, or from twelve different square tables, 
in which case one standard method of finding equivalents will serve all 
purposes . 



Equations (1) and (2) are the most widely used and are referred to m cryptographic literature as the 
Vigenere type of encipherment, (5) and (6) are the equations of the Beaufort type, and (9) and (10) are the 
Delastelle type 
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h . If but one table such ae that shown below in Fig. 9 is employed, 
the various methods of finding equivalents are difficult to keep in mind. 

ABCDEFGHIJKLMHOPQRSTUVWXYZ 

FBPYRC QZIGSEHTDJUMKV ALWNOX 
BPYRC QZIGSEETD JUMKT ALWNOXF 
PYRCQZIGSEHTDJUMKVALWHOXFB 
YRCQZIGSEETDJDMKV ALVHOXFBP 
RCQZIGSEHTDJUMKVALWHOXFBPY 
CQZIGSEHTDJUMKVALWKOXFBPYR 
QZIGSEHTDJUMKVALWNOXFBPYRC 
ZIGSEHTDJUMKVALWHOXFBPYRCQ 
IGSEHTDJUMKVALWHOXFBPYRCQZ 
GSEHTDJUMKV ALWHOXFBPYRC QZI 
SEHTDJUMKYALHKOXFBPYRCQZIG 
EHTDJUMKVALWHOXFBPYRCQZIGS 
HTDJUMKVALWHOXFBPYRCQZIGSE 
TDJUMKVALWHOXFBPYRCQZIGSEH 
DJUMKVALWHOXFBPYRCQZIGSEHT 
JBMKV ALWHOXFBPYRC QZIGSEETD 
UMKV ALWROXFBPYRC QZIGSEHTDJ 
MKVALWHOXFBPYRC QZIGSEHTDJU 
K V ALVN0XFBPYRCQZIG8EHTDJUH 
VALVNOXFBPYRC QZIGSEHTDJUMK 
ALVHOXFBPYRCQZIGSEHTDJUMKV 
LWHOXFBPYRC QZIGSE5TDJUMKVA 
WROXFBPYRCQZIGSEHTDJUMKVAL 
HOXFBPYRCQZIGSEHTDJUMKVALW 
OXFBPYRCQZIGSEHTDJUMKVALWH 
XFBPYRCQZIGSEHTDJXJMKV ALWHO 



Figure 9. 



For example: 

(l) For enciphering equations e*/2 ■ ©i/i; ©p/l * ©e/2* 

Locate 8p in top sequence; locate 0£ in first column; 0c is the 
letter within the square at intersection of the two lines thus 
determined. 

Thus: 

K k/2 " A i/1 ; P p/1 * Z c/2 
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(2) For enciphering equations 0^/g * ®i/i> ®p/2 * ®c/l s 

Locate 6k in first column; follow line to right to 6p; proceed 
up this column; 0 C is letter at top. 

Thus: 

K k/2 * A i/l* p p/2 “ tyl 

(3) For enciphering equations 0^^ * 0^; ®p/i B ®c/2 : 

Locate 0^ in top sequence and proceed down column to 0^; locate 
0p in top sequence; 0 C is letter at other corner of rectangle 
tnus formed . 

Thus: 

Kfc/l * A i/2 ; P p/l 8 X c/2 

Only three different methods have heen shown and the student no doubt 
already has encountered difficulty in keeping them segregated in his mind. 

It would obviously be very confusing to try to remember all twelve methods, 
but fortunately this is not necessary. If one standard or fixed method of 
finding equivalents is followed with several different tables, this dif- 
ficulty disappears . Suppose that the following method is adopted: Arrange 
the square so that the plaintext letter may be sought in a separate sequence, 
arranged alphabetically, above the square and so that the key letter may be 
sought in a separate sequence, also arranged alphabetically, to the left of 
the square; look for the plaintext letter in the top row; locate the key 
letter in the 1st column to the left; find the letter standing within the 
square at the intersection of the vertical and horizontal lines thus deter- 
mined. Then twelve squares, equivalent to the twelve different conditions 
listed in subpar. f, can readily be constructed. However, to avoid con- 
fusing the student - with a multiplicity of unnecessary details which have 
no direct bearing upon basic principles, one and only one standard method 
of finding equivalents by means of sliding components will be selected from 
among the twelve available, as set forth in the preceding subparagraphs. 
Unless otherwise stated, this method will be the one denoted by the first 
of the formulas listed in subpar. f, viz .: 

®k/2 * ®i/l» ®p/l “ ®c/2 

Calling the plain component ”1" and the cipher component ”2", this will 
mean that the key letter on the cipher component will be set opposite the 
index, which will be the first letter of the plain component; the plain- 
text letter to be enciphered will then be sought on the plain component 
and its equivalent will be the letter opposite it on the cipher component. 
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CHAPTER III 

THEORY OF SOLUTION OF REPEATING -KEY SYSTEMS 



Paragraph 



The three steps m the analysis of repeating -key systems 14 

First step finding the length of the period IS 

General remarks on factoring 16 

Second step distributing the cipher text into the component monoalphabets 1 1 

Statistical proof of the monoalphabeticity of the distributions 18 

Third step solving the monoalpha betic distributions 19 



l4. The three steps in the analysis of repeating -key systems -a . The 
method of enciphering ~ac cording to the principle of the repeating key" has 
been illustrated in subpar. 3b. The analysis of a cryptogram produced by a 
periodic polyalphabetic system, regardless of the kind of cipher alphabets 
employed, or their method of production, resolves itself into three dis- 
tinct and successive steps: 

(1) Determination of the length of the repeating key, which is the 
same as the determination of the exact number of alphabets involved in the 
cryptogram. 

(2) Allocation or distribution of the letters of the cipher text into 
the respective cipher alphabets to which they belong. This is the step 
which reduces the polyalphabetic text to monoalphabetic terms. 

(3) Analysis of the individual monoalphabetic distributions to deter- 
mine plaintext values of the cipher letters in each distribution or alphabet. 

b. The foregoing steps will be treated in the order in which mentioned. 
The first step may be described briefly as that of determining the period . 
The second step may be described briefly as that of reduction to monoalpha - 
betlc terms . The third step may be designated as identification of cipher - 
text values . 



1$. First step: finding the length of the period. — a. The determina- 

tion of the period, that is, the length of the key or the number of cipher 
alphabets involved in a cryptogram enciphered by the repeat mg -key method 
is, as a rule, a relatively simple matter. The cryptogram itself usually 
manifests externally certain phenomena which are the direct result of the 
use of a repeating key. The principles involved are, however, so fundamen- 
tal in cryptanalysis that their elucidation warrants a somewhat detailed 
treatment. This will be done in connection with a short example of encipher 
ment, shown in Fig. 10. 

Message 

THE ARTILLERY BATTALION MARCHING IN THE REAR OF THE ADVANCE GUARD 
KEEPS ITS COMBAT TRAIN WITH IT INSOFAR AS PRACTICABLE. 



CONFIDENTIAL 



23 



REF ID:A64563 



(Key: BLUE, using direct standard alphabets) 

Cipher Alphabets 

.... ABCDEFG'HIJKLMNOPQRSTUVWXYZ 

(1) BCDEFGHIJKLMNOPQRSTUVWXYZA 

(2) LMNOPQRSTUVWXYZABCDEFGHIJK 

(3) .... D V « X Y Z A B C D E F G H I J K L M B O P Q R S T 
(U)....EFGHIJKLMNOPQRSTUVWXYZABCD 



BLUE 


BLUE 


BLUE 


BLUE 


T H E A 


A R D K 


T H E A 


A R D K 






U S Y E 


B C X 0 


R T I L 


E E P S 


R T I L 


E E P S 






S E C P 


F P J W 


L E R Y 


I T S C 


L E R Y 


I T S C 






M P L C 


J E M G 


B A T T 


0 M B A 


B A T T 


0 M B A 






C L N X 


P X V E 


ALIO 


T T R A 


ALIO 


T T R A 






B V C S 


U E L E 


N M A R 


I N W I 


N M A R 


I N W I 






0 X U V 


J Y Q M 


CHIN 


T H I T 


CHIN 


T H I T 






DSCR 


U S C X 


G I N T 


I N S 0 


G I N T 


I N S 0 






H T H X 


J Y M S 


HERE 


F A R A 


HERE 


F A R A 






I P L I 


G L L E 


A R 0 F 


S P R A 


A R 0 F 


S P R A 






B C I J 


TALE 


T H E A 


C T I C 


T H E A 


C T I C 






U S Y E 


D E C G 


D V A N 


ABLE 


D V A N 


ABLE 






E G U R 


B M F I 



CEGU CEGU 

D P A Y 



Figure 10. 
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Cryptogram: 



YES 


E C P M P 


L C C L N 


X B W C S 


OXDVD 


SCR 


I P L 


I B C I J 


U S Y E E 


G U R D P 


A Y B C X 


0 F P 


MOP 


X V E 0 E 


LE JYQ 


M U S C X 


J Y M S G 


L L E 


DEC 


6 B M 7 I 











b . Regardless of vhat system is used, Identical plaintext letters 
enciphered by the same cipher alphabet 1 must yield identical cipher letters. 
Referring to Fig. 10, such a condition is brought about every time that 
identical plaintext letters happen to be enciphered with the same key let- 
ter (l.e., every time Identical plaintext letters fall into the same column 
In the encipherment) 2 Nov since the number of columns or positions with 
respect to the key is very limited (except in the case of very long key 
vords), and since the repetition of letters is an inevitable condition in 
plain text, it follows that there vill be in a message of fair length many 
cases where identical plaintext letters must fall Into the same column. 

They vill thus be enciphered by the same cipher alphabet, resulting, there- 
fore, in the production of many Identical letters in the cipher text and 
these will represent identical letters in the plain text. When identical 
plaintext polygraphs fall into identical columns the result 1 b the forma- 
tion of identical ciphertext polygraphs, that is, repetitions of groups of 
2, 3, . letters are exhibited in the cryptogram. Repetitions of 

this type vill hereafter be called causal repetitions , because they are 
produced by a definite, traceable cause, viz ., the encipherment of identical 
letters by the same cipher alphabets . 



c. It vill also happen, however, that different plaintext letters 
falling in different columns vill, by mere accident, produce identical 
cipher letters. Note, for example, in Fig. 10 that in the first column 
(under Bfc) , Rp becomes S c and that in the second column (under L&) , Hp also 
becomes S c . The production of an identical ciphertext letter in these two 
cases (that is, a repetition where the plaintext letters are different 
alphabets) is merely fortuitous. It is, in everyday language, "a mere 
coincidence", or "an accident." For this reason repetitions of this type 
vill hereafter be called accidental repetitions . 

d. A consideration of the phenomenon pointed out In subpar. c makes 
it obvious that in polya lphabetic ciphers it is important that thie crypt- 
analyst be able to tell whether the repetitions he finds in a specific 



1 It is to be understood of course that cipher alphabets with single equivalents are meant m this case 

n 

c The frequency with which this condition may be expec ted to occur can be definitely calculated A 
discussion of this point will be treated in Milit a ry Crypta nalytics, Part HI 
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case are causal or accidental in their origin, that is, whether they 
represent actual encipherments of identical plaintext letters by iden- 
tical keying elements, or mere coincidences brought about purely for- 
tuitously. 

e. Row accidental repetitions will, of course, happen fairly fre- 
quently with individual letters, but less frequently with digraphs, because 
in this case the same kind of an "accident" must take place twice in suc- 
cession. Intuitively one feels that the chances that such a purely 
fortuitous coincidence will happen two times in succession must be much 
less than that it will happen every once in a while in the case of single 
letters. Similarly, intuition makes one feel that the chances of such 
accidents happening in the case of three or more consecutive letters are 
still less than in the case of digraphs, decreasing very rapidly as the 
repetition increases in length. 

f . The phenomena of cryptographic repetition may, fortunately, be 
dealt with statistically, thus taking the matter outside the realm of 
intuition and putting it on a firm mathematical or objective basis . 
Moreover, often the statistical analysis will tell the cryptanalyst when 
he has arranged or rearranged his text properly, that is, when be is 
approaching or has reached monoalphabet icity in his efforts to reduce 
polyalpbabetic text to its simplest terms. By means of the binomial dis- 
tribution, 3 it is possible to compute tables of the expected number of 
digraphs, trigraphs, and other polygraphs occurring exactly 0, 1, 2, 

3, ... x tunes in a sample of random text of a given size; then the 
repetitive phenomena in a cryptogram under study may be compared with the 
phenomena expected by pure chance (i.e., in samples of random text of the 
same size as the cryptogram) as a means of evaluating whether or not the 
observed repetitions and their number are significant. If the observed 
repetitive phenomena are no more than would normally be expected by chance, 
then these phenomena cannot be used as a basis for cryptanalytic attack. 

If however these repetitions are highly unlikely to have occurred by 
chance, then they are open to interpretation and exploitation. The tables 
derived from the binomial distribution are given in subpar. g, below. 4 



3 This distribution, as well as the Poisson exponential distribution (which is an approximation to the 
binomial) will be treated m Military Crypt analytics Part III 

A 

The tables illustrated here have been computed using the formula for the number of comparisons as 
(N-t+l)(N-t) where N is the number of letters in the sample size and is the length of the polygraph 
2 

Strictly speaking, the formula ( N-2t->2) (N 2t+l) should be used to discount overlapping repetitions such 

2 

as the "repeated tetragraph' in the sequence ABCABCA, however in most statistical computations 
especially where analytical machine techniques axe employed the scoring is almost invariably predicated 
upon the first formula The two formulas are practically equivalent, except for small values of N when 
the second formula is the more precise one for the number of comparisons 



l 
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g. Fig. 11a is a table of the expected number of digraphs appearing 
exactly 2, 3» 4,”. • • 10 times in samples of random text of sizes 100 to 
1,000 letters, by hundreds. Fig. lib is a table of the expected number 
of trigraphs appearing exactly 2, 37 ®nd 4 times by chance in these sample 
sizes, and Figs. 11c and d contain the data for tetragraphs and pentagraphs, 
respectively. As an illustration of the use of these tables, from Fig. 11a 



Ho. of 
Letters 



Expected number of digraphs occurring exactly x times 
E(2) E(3) E(4) E(5) E(6) E(7) E(8) E(9) E(lO) 



100 


6.21 


0.298 


0.011 












200 


21.8 


2.12 


0.154 


0.009 










300 


42.5 


6.23 


0.683 


0.060 


0.004 








400 


65.3 


12.8 


1.87 


0.220 


0.022 


0.002 






500 


88.1 


21.6 


3.97 


0.582 


0.071 


0.008 






600 


110 


32.3 


7.11 


1.25 


0.184 


0.023 


0.003 




700 


129 


44.3 


11.4 


2.35 


0.403 


0.059 


0.008 


0.001 


800 


145 


57.1 


16.8 


3.96 


0.777 


0.130 


0.019 


0.003 


900 


158 


70.1 


23 .2 


6.16 


1.36 


0.257 


0.043 


0.006 


1000 


169 


83.O 


30.6 


9.03 


2.21 


0.466 


0.085 


0.014 



0.001 

0.002 



Figure 11a. 



Ho. of 
letters 


Exp. no 
E(2) 


. of trigraphs 
E(3) E(4) 


100 


0.269 


0.001 




200 


1.10 


0.004 




300 


2.48 


0.014 




400 


4.4o 


0.033 




500 


6.85 


0.064 




600 


9.81 


0.111 


0.001 


700 


13.3 


0.175 


0.002 


800 


17.3 


0.261 


0.003 


900 


21.8 


0.371 


0.005 


1000 


26.8 


0.505 


0.008 



Ho. of 
letters 


Tetragraphs 
E(2) E(3) 




Ho. of 
letters 


Fenta . 
E(2) 


100 


0.010 






100 




200 


0.043 






200 


0.002 


300 


O.O96 






300 


0.004 


400 


0.171 






400 


0.007 


500 


0.270 






500 


0.011 


600 


0.389 






600 


0.015 


700 


0.530 






700 


0.021 


800 


0.693 






800 


0.027 


900 


0.877 






900 


0.034 


1000 


1.08 


0.001 




1000 


0.042 



Figure lib. Figure 11c. Figure lid. 



we observe that in a sample of 300 letters of random text we may expect 
about 43 (rounded off to the nearest integer) digraphs to occur twice, 

6 digraphs to occur three times, and about 1 digraph to occur four times. 
The meaning of the decimal fractions in that row under E(4), E(5), and 
E(6) may be Interpreted as follows: the entry 0.683 under E(4) means 

that in 100 samples of 300 random letters each, about 68 of them will have 
a digraph occurring 4 times within the sample, the entry 0.060 under E(5) 
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means that In 100 samples of 300 random letters each, 6 of them will 
have a digraph occurring 3 times; and the entry 0.004 under E(6) means 
that in 1,000 samples of 300 random letters, 4 of them may be expected 
to have a digraph occurring 6 times. From Fig. lib, ve note that a 
sample of 300 random letters may be expected to contain 2 or 3 trigraphs 
occurring tvlce; and in 1,000 of such samples , 14 may be expected to 
contain a trigraph occurring three times. From Fig. 11c, ve note that in 
1,000 samples of 300 random letters, 96 of them may be expected to contain 
a repeated tetragraph, while the chance of a tetragraph occurring three 
times in these 1,000 samples is so small as to be practically non-existent, 
note that, under E(3) of the last row of this Figure, if ve had 1,000 
samples of 1,000 letters each, only 1 of them may be expected to contain 
a threefold occurrence of a tetragraph. From Fig. lid, ve see that if ve 
had 1,000 samples of 300 random letters, only 4 of them may be expected 
to contain a pentagraphic repetition (i.e., a pentagraph occurring tvlce), 
and that in these 1,000 samples there is, in unmathematical but neverthe- 
less precise language, not a ghost of a chance that a pentagraph vill occur 
three times. 

h. The foregoing tables may also be used to determine the cumulative 
values of digraphs and polygraphs expected to appear x or more times in 
samples of random text. Using Fig. 11a as an example, in a 300-letter 
sample of random text, if the entries under E(2) to E(6) are added together, 
the sum (49.477) Indicates that about 49 digraphs may be expected to occur 
at least tvlce (i.e., two or more times); if the values E(3; to E(6) are 
added together, the sum (6.977) shows that 7 digraphs may be expected to 
occur three or more times; if the entries under E(4) to E(6) are added 
together, the sum (0.747) shows that in 100 such samples of random text, 
about 75 of them will contain a digraph occuring at least four times; and 
if the entries under E(5) and E(6) are added, their sum (O.O65) shovs that 
in 1,000 300-letter samples of random text, 65 of these may be expected to 
contain a digraph occurring five or more times. 

1. As an illustration of the application of the foregoing discussion, 
it is indicated that if a cryptanalyst vere to have at hand only the crypto- 
gram of Fig. 10, vlth the repetitions underlined as below, a statistical 
study of the number and length of the repetitions vithin the message would 
tell him that while some of the digraphic repetitions may be accidental, 
the chances that they all are accidental are small. In the case of the 
tetragraphlc repetition he would realize that the chances of its being 
accidental are very small Indeed. 

U S Y E S EjC p M P LCCLH XBWCS OXUVD SCRHT 

HX I PL I B_C I J U S Y E E GURDP A Y B_C X OFPJW 

JEMGP XVEUE L_E JJC ft M U S C X J_Y M S G L L E T A 

LEDEC GBMFI 
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A consideration of the facts therefore leads to hut one conclu- 
sion, viz . , that the repetitions exhibited by the cryptogram under investi- 
gation are not accidental but are causal in their origin; and the cause is 
in this case cot difficult to find: repetitions in the plain text were 

actually enciphered by Identical alphabets. In order for this to occur, 
it was necessary that the tetragraph US YE, for example , fall both times in 
exactly the same relative position with respect to the key. Note, for 
example , that USYE in Fig. 10 represents in both cases the plaintext poly- 
graph THEA. The first time It occurred it fell In positions 1-2-3-4 with 
respect to the key, the second time it occurred it happened to fall in the 
very same relative positions, although it might Just as well have happened 
to fall in any of the other three possible relative positions with respect 
to the key, viz., 2-3-4-1, 3-^-1 -2, or 4 -1-2 -3. 

k. Lest the student be misled, however, a few more words are necessary 
on this subject. In the preceding Bubparagraph the word "happened" was used; 
this word correctly expresses the idea in mind, because the insertion or 
deletion of a single plaintext letter between the two occurrences would 
have thrown the second occurrence one letter forward or backward, respec- 
tively, and thus caused the polygraph to be enciphered by a sequence of 
alphabets such as can no longer produce the cipher polygraph USYE from the 
plaintext polygraph THEA. On the other hand, the insertion or deletion of 
this one letter might bring the letters of some other polygraph into similar 
columns so that some other repetition would be exhibited in case the USYE 
repetition had thus been suppressed. 

l. The encipherment of similar letters by similar cipher alphabets 
is therefore the cause of the production of repetitions in the cipher text 
in the case of repeating -key ciphers. What principles can be derived from 
this fact, and how can they be employed in the solution of cryptograms of 
this type? 

m. If a count is made of the number of letters from and including the 

firat _ USYE to, but not including, the second occurrence of USYE, a total of 
40 letters is found to intervene between the two occurrences. This number, 
40, must, of course, be an exact multiple of the length of the key. 4 Having 

the plain text before one, it is easily seen that it is the 10th multiple; 

that is, the 4-letter key has repeated itself 10 times between the first and 
the second occurrence of USYE. It follows, therefore, that if the length 

of the key were not known, the number 40 could safely be taken to be an 
exact multiple of the length of the key; in other words, one of the factors 
of the number 40 would be equal to the length of the key. The word "safely" 
is used in the preceding sentence to mean that the Interval 40 applies to a 
repetition of 4 letters and it has been Bhown that the chances are small 
that this repetition is accidental. The factors of 40 are 2, 4, 5, 8, 10, 
and 20. So far as this single repetition of USYE is concerned, if the length 

of the key were not known, all that could be said about the latter would be 



4 Barring that is cases such as those mentioned m subpar 16b and in footnote 6 on p 32 
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that it is equal to one of these factors. Kxe repetition by itself gives 
no further indications. How can the exact factor be selected from among 
a list of several possible factors? 



n. Let the intervals between all the repetitions in the cryptogram 
be listed. They are as follows: 



Repetition 


Interval 


Factors 


1st USYE to 2d USYE 


4o 


2, 4, 5, 8, 10, 20 


1st BC to 2d BC 


16 


2, 4, 8 


1st CX to 2d CX 


25 


5 


1st EC to 2d EC 


88 


2, 4, 11, 22, 44 


1st LE to 2d LE 


16 


2, 4, 8 


2d LE to 3d LE 


4 


2 


1st LE to 3d LE 


20 


2, 4, 5, 10 


1st JY to 2d JY 


8 


2, 4 


1st PL to 2d PL 


24 


2, 3, 4, 6, 8, 10, 12 


1st SC to 2d SC 


52 


2 , 4, 13 , 26 


(1st SY to 2d SY, already included in USYE.) 






(1st US to 2d US , already included in USYE. ) 






2d US to 3d US 


36 


2, 3, 4, 6, 9, 18 


1st US to 3 US 


76 


2 , 4, 19 , 38 


(1st YE to 2d YE, already included in USYE.) 







o. Are all these repetitions causal repetition? Since, from Fig. llc_, 
we find that the expected number of tetragraphs appearing twice (i.e., a 
tetragraphic repetition) in 100 letters of random text is 0 . 01 , this decimal 
fraction means that in 100 such cases only 1 may be expected to contain a 
repeated tetragraph; thus it is a 99-to-l chance of the USYE repetitions 
occurring accidentally. From Fig. 11a, the expected number of digraphs 
occurring 3 times is 0.293; so the chances against the threefold occurrence 
of the two digraphs LE and US are quite high. We expect only 6.5 digraphs 
to occur at least 2 times in 100 letters of random text, but in our sample 
we have 10 digraphs appearing two or more times. The chances are very 
great, therefore, that the majority of these repetitions are causal, so that 
it is not astonishing that the Intervals betweeen all the various repetitions, 
except in one case, contain the factors 2 and 4. 

£. This means that if the cipher is written out in either 2 columns 
or 4 columns, all these repetitions (except the CX repetition) would fall 
into the same columns. From this it follows that the length of the key is 
either 2 or 4, the latter, on practical grounds, being more probable than 
the former. Doubts concerning the matter of choosing between a 2-letter 
and a 4-letter key will be dissolved when the cipher text is distributed 
into its component uniliteral frequency distributions. 




30 









REF ID:A64563 



- 60HFIDEHTIAL 



£. The repeated digraph CX xn the foregoing message is an accidental 
repetition, as will be apparent by referring to Fig. 10. Had the message 
been longer there would have been more such accidental repetitions, but, 
on the other hand, there would be a proportionately greater number of 
causal repetitions. This is because the phenomenon of repetition in plain 
text is so all -pervading. 

r. Sometimes it happens that the cryptanalyst quickly notes a repe- 
tition of a polygraph of four or more letters, the interval between the 
first and second occurrences of which has only two factors, of which one 
is a relatively small number, the other a relatively high prime number . 5 
He may therefore assume at once that the length of the key is equal to the 
smaller factor without searching for additional recurrences upon which to 
cor robot ate his assumption. Suppose, for example, that in a relatively 
short cryptogram the interval between the first and second occurrences of 

a polygraph of five letters happens to be a number such as 203 , the factors 
of which are ^ and 29. Evidently the number of alphabets may at once be 
assumed to be 7, unless one is dealing with messages exchanged among 
correspondents known to use long keys. In the latter case one could assume 
the number of alphabets to be 29* 

s. The foregoing method of determining the period in a polyalphabetic 
cipher is commonly referred to in the literature as "factoring the inter- 
vals between repetitions", or more often it is simply called "factoring." 
Because the latter is an apt term and is brief, it will be employed here- 
after in this text to designate the process. 

t'. As an aid in the determination of possible periods in cases under 
study 7 there is given at the end of this chapter a table of the factors of 
all numbers from 1 to 400 inclusive (cf. pp. 4 i _ 44 }, 

16. General remarks on factoring. --a. The statement made in par. 4 
with respect to the cyclic phenomena said to be exhibited in cryptograms 
of the periodic type now becomes clear. The use of a short repeating key 
produces a periodicity of recurrences or repetitions collectively termed 
"cyclic phenomena", an analysis of which leads to a determination of the 
length of the period or cycle, and this gives the length of the key. Save 
for a rare exception mentioned below, only in the case of relatively short 
cryptograms enciphered by a relatively long key does factoring fail to lead 
to the correct determination of the number of cipher alphabets in a repeating- 
key cipher; and of course, the fact that a cryptogram contains repetitions 
whose factors show constancy is in itself an indication and test of its 
periodic nature. It also follows that if the cryptogram is not a repeating- 
key cipher, then factoring will show no definite results, and conversely the 
fact that it does not yield definite results at once indicates that the 
cryptogram is not a periodic, repeating -key cipher. 



5 



A prune number is defined as one which is exactly divisible only by itself and 1 
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b. There are two main cases in which factoring leads to no definite 
results. One is in the case of monoalphabetic substitution ciphers. Here 
recurrences are very plentiful as a rule, and the intervals separating 
these recurrences may be factored, but the factors will show no constancy , 
there will be several factors common to many or most of the recurrences. 

This in itself is an indication of a monoalphabetic (monographic) substi- 
tution cipher, if the very fact of the presence of many recurrences fails 
to impress itself upon the inexperienced cryptanalyst. The other case in 
which the process of factoring is nonsignificant involves certain types 
of nonperiodic, polyalphabet ic ciphers. In certain of these ciphers, 
recurrences of digraphs, trigraphs, and even longer polygraphs may be 
plentiful in a long message, but the Intervals between such recurrences 
bear no definite multiple relation to the length of the key, such as in 
the case of the true periodic, repeating -key cipher, in which the alphabets 
change with successive letters and repeat themselves over and over again . 6 

c. Factoring is not the only method of determining the length of the 
period of a periodic, polyalph&betic substitution cipher, although it is by 
far the most common and easily applied. At this point it will merely be 
stated that when the message under study is relatively short in comparison 
with the length of the key, so that there are only a few cycles of cipher 
text and no long repetitions affording a basis for factoring, there are 
several other methods available. However, it being deemed Inadvisable to 
Interject the data concerning those other methods at this point, they will 
be explained subsequently. It is desirable at this juncture merely to 
Indicate that methods other than factoring do exist and are used in practi- 
cal work. 

d. Fundamentally, the factoring process is merely a more -or -less 
simple mathematical method of studying the phenomena of periodicity in 
cryptograms. It will usually enable the cryptanalyst to ascertain definitely 
whether or not a given cryptogram is periodic in nature, and if so, the 
length of the period, stated in terms of the cryptographic unit involved . 

By the latter statement is meant that the factoring process may be applied 
not only in analysing the periodicity manifested by cryptograms in which 
the plaintext units subjected to cryptographic treatment are monographic 
in nature (i.e., are single letters) but also in studying the periodicity 
exhibited by those occasional cryptograms wherein the plaintext units are 
digraphic, trigraphic, or n -graphic in character. The student should bear 
this point in mind when he~comes to the study of substitution systems of the 
latter sort. 



g 

One further case which might be mentioned is that of periodic ciphers in which the key word or phrase 
contains repeated polygraphic segments, such as m N ATION ALORGANIZ ATION A five-letter word en- 
ciphered in alphabets 2-6 will have the same ciphertext equivalents as the same word enciphered in 
alphabets 16-20, thus giving rise to a ca usal repetition, but the interval between the occurrences will not 
reflect the length of the true period Such repetitions are referred to as being the result of the sub-cycles 
in the total key, these phenomena are often encountered in the study of certain machine cipher systems 
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17. Second step; distributing the cipher text Into the component 
aonoalpha.be ts . — a. After the number of cipher alphabets involved in the 
cryptogram has been ascertained, the next step is to rewrite the message 
in groups corresponding to the length of the key, or in columnar fashion, 
whichever is more convenient, and this automatically divides up the text so 
that the letters belonging to the same cipher alphabet occupy similar posi- 
tions in the groups, or, if the columnar method 1 b used, fall in the same 
column. The letters are thus allocated or distributed into the respective 
cipher alphabets to vhich they belong. This reduces the polyalphabetic 
text to monoalphabetic terms. 

b. Then separate unlliteral frequency distributions for the thus 
isolated individual alphabets are compiled. For example, in the case of 
the cipher in subpar. 15i, having determined that four alphabets are in- 
volved, and having rewritten the message in four columns, a frequency 
distribution is made of the letters in the first column, another is made 
of the letters in the second column, and so on for the four columns. 

Bach of the resulting distributions is therefore a monoalphabetic fre - 
quency distribution . If these distributions do not give the characteristic 
Irregular crest-and-trough appearance of monoalphabetic frequency distri- 
butions, including the expected number of blanks U\), and if the of 
these distributions do not meet the range of the expected value of 
(or do not yield I.C.'s in the close vicinity of the expected value of 
1.73) , then the analysis which led to the hypothesis as regards the num- 
ber of alphabets involved is fallacious. In fact, the $ or I.C. of these 
Individual distributions may be considered to be an index of the correct- 
ness of the factoring process; for theoretically, and practically, the 
individual distributions constructed upon the correct hypothesis will tend 
to conform more closely to the expected or I.C. of a monoalphabetic fre- 
quency distribution than vill the distributions constructed upon an incor- 
rect hypothesis. These considerations will be discussed in the next para- 
graph. 

18. Statistical proof of the monoalphabeticity of the distributions. 
—a. The student is already familiar with the monographic 4> teat for de- 
termining the relative monoalphabeticity of a distribution; this test was 
discussed in detail in par. 27 of Military Cryptanalytics. Part I . The 
formulas for monographic and were stated as ^ ■.05b7B(H-lT, and 

■ . 0385H (B-l), where H is the total number of elements in the distribu- 
tion. The i> Q was calculated by the formula (f-l) , where f is the 

frequency of each element of the distribution. The I.C. was defined as 
the ratio of to fo.; the monographic I.C. of English plain text was 
given as 1.73, as compared with the I.C. of 1.00 for random text. 7 

b. The 4> test may be applied to the distributions of periodic poly- 
alphabetic ciphers to confirm the monoalphabeticity of the distributions 
(made on an hypothesis of n alphabets) and thereby confirm the length of 
the period; this test is particularly applicable in difficult cases, as for 



7 A more convenient formula for the monographic I C is 26?f(f-l), which is equivalent to 

N(N-1) 
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instance where there are insufficient polygraphic repetitions in a short 
text, or where the factoring resolves itself into two or more periods. 

If the correct period is assumed, then the 4 test applied to each of the 
alphabets should approximate fairly closely and consistently the value 
for and, conversely, if an Incorrect period is assumed, the should 
approximate the value of 4>r more than it does $p. It is to be remarked 
that small deviations for the expected values are usual, and Indeed is the 
normal situation, but that large deviations are rare. The degree of devia- 
tion that may be expected may be determined by statistical means, under 
the concept of the standard deviation of <fr; however, this topic is reserved 
for treatment in Military Cryptanalytlcs , Part III . 

c. For reference purposes, there is appended in Fig. 12. below, a 
table of the expected values of and fo* for sample sizes (N; from 11 to 
100, inclusive. Since the l.C. is an expression of monoalphabeticity in 
terms of a ratio , the evaluation of distributions will be expressed in 
terms of the l.C. in the future, unless the $ values are more convenient 
in specific cases. 





Op 


Or 


N 


Op 


Or 


N 


Op 


Or 


H 


*P 


Or 


N 


Op 


Or 


Em 


7.34 


4.23 


29 


54 


31 


4? 


144 


83 


65 


277 


160 


83 


454 


262 




8.80 


5.08 


30 


58 


33 


48 


150 


87 


66 


286 


165 


84 


465 


268 




10.4 


6.00 


31 


62 


36 


49 


157 


90 


67 


295 


170 


85 


476 


275 


Btj 


12.1 


7.00 


32 


66 


38 


50 


163 


94 


68 


304 


175 


86 


488 


281 


■r 


14.0 


8.08 


33 


70 


4l 


51 


170 


98 


69 


313 


180 


87 


499 


288 




16.0 


9.23 


34 


75 


43 


52 


177 


102 


70 


322 


186 


88 


511 


294 




18.1 


10.5 


35 


79 


46 


53 


184 


106 


71 


331 


191 


89 


522 


301 




20.4 


11.8 


36 


84 


48 


54 


191 


110 


72 


341 


197 


90 


534 


308 




22.8 


13.2 


37 


89 


51 


55 


198 


n4 


73 


351 


202 


91 


546 


315 




25.3 


14.6 


38 


94 


54 


56 


205 


118 


74 


360 


208 


92 


558 


322 




28.0 


16.2 


39 


99 


57 


57 


213 


123 


75 


370 


213 


93 


571 


329 


K' 


30.8 


17.8 


40 


104 


60 


58 


221 


127 


76 


380 


219 


94 


583 


336 


Ec 


33 8 


19.5 


4l 


109 


63 


59 


228 


132 


77 


390 


225 


95 


59b 


343 


K' 


36.8 


21.2 


42 


H5 


66 


60 


236 


136 


78 


401 


231 


96 


608 


351 




40.0 


23.1 


43 


120 


69 


61 


244 


141 


79 


411 


237 


97 


621 


356 


* 


43.4 


25.0 


44 


126 


73 


62 


252 


145 


80 


422 


243 


98 


634 


366 


m £, 


46.8 


27.0 


45 


132 


76 


63 


261 


150 


81 


432 


249 


99 


647 


373 




50.4 
■ ■ 


29.1 


46 


138 


80 


64 


269 


155 


82 


443 


255 


100 


660 


381 



Figure 12. 
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d. The uniliteral distributions for the four columns of cipher text 
in Fig. 10 are made, and are shovn below together vith the $ and I.C. 
values for these distributions: 



A B 



8 


♦ ■ 36 


KLMNOPQRSTUVWXYZ 


(I.C. » 


Alphabet 1 




. _ S E _ _■» 


4> = 44 


KLMNOPQRSTUVWXYZ 


(I.C. = 


Alphabet 2 




^ = _ _ _ _ _ _ 


4> = 46 


KLMNOPQRSTUVWXYZ 


(I.C. » 


Alphabet 3 




_ — 


* * 44 


KLMNOPQRSTUVWXYZ 


(I.C. « 


Alphabet 4 





It can be seen that these distributions are clearly monoalphabetic , since 
the <> values are in the vicinity of <|>p (which, for this size sample, is 
40) rather than close to ^ (in this case, 23) . It is pointed out that 
any other assumed periods, which are not a multiple of 4 , will not yield 
monoalphabetic distributions. But if in this case a period of 8 were as- 
sumed, these 8 distributions would be monoalphabetic, however it would be 
noticed that the distributions for alphabets 1 and 5 would be quite similar, 
and likewise alphabets 2 and 6, 3 and 7, and 4 and 8 — therefore these 8 
distributions could then be combined into the four distributions of the 
correct hypothesis. 8 

e. A further application of the ^ test should be considered at this 
time, that is, the cases where the length of the period is large as com- 
pared vith the size of the sample of cipher text. 9 Although a single ^ 
test for small values of N would rarely give a reliable result, it is 
nevertheless possible to apply this test for small values of N, provided it 
is possible to obtain the average for a number of such tests . Hsus it is 
usually possible to deteraiine the period of a polyalphabetic cipher, where 
the number of alphabets is large and the number of letters per distribution 
is small, even though there are no long repetitions. 



o 

Cf the discussion on the ")({chi) lest in par 37 

8 The discussion which follows and the example illustrated are based on certain parts of the pioneer work 
of Dr Solomon Kullback in his treatise Statistical Methods in Cryptanalysis (Revised Edition), Washington 
1938 
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(1} Let us consider the following cryptogram which is known to be 
enciphered by periodic polyalphabetic substitution, where the number of 
alphabets is between 40 and 50: 



H 


S 


K 


U 


S 


P 


M 


F 


H 


0 


U 


J 


J 


I 


X 


M 


S 


P 


T 


P 


0 


I 


P 


C 


I 


w 


K 


Z 


V 


U 


Y 


P 


P 


N 


£ 


U 


S 


A 


I 


G 


B 


0 


0 


G 


A 


0 


P 


G 


P 


R 


E 


B 


0 


U 


C 


s 


E 


P 


V 


G 


H 


Q 


X 


Z 


S 


A 


c 


K 


R 


K 


V 


B 


G 


E 


M 


V 


S 


F 


R 


Y 


T 


T 


K 


E 


K 


V 


W 


Z 


X 


V 


L 


I 


J 


H 


W 


A 


R 


L 


K 


F 


I 


J 


S 


L 


T 


M 


H 


K 


A 


H 


Q 


T 


U 


V 


T 


X 


S 


M 


E 


C 


F 


C 


s 


K 


T 


G 


0 


0 


Y 


B 


X 


Z 


V 


L 


I 


J 


R 


Y 


A 


C 


D 


W 


E 


J 


M 


s 


C 


A 


F 


P 


I 


s 


A 


X 


0 


K 


A 


Q 


D 


W 


E 


X 


p 


Y 


P 


Q 


H 


D 


N 


0 


J 


I 


X 


N 


Z 


J 


G 


N 


U 


D 


0 


A 


R 


F 


U 


E 


R 


J 


0 


Y 


B 


D 


0 


K 


E 


I 


K 


D 


U 


V 


T 


D 


V 


E 


V 


L 


E 


T 


D 


0 


A 


F 


R 


0 


U 


H 


Y 


H 


B 


D 


V 


Q 


0 


B 


E 


G 


G 


S 


E 


Q 


E 


X 


0 


P 


u 


Z 


C 


0 


C 


U 


K 


K 


Z 


L 


T 


P 


H 


K 


R 


T 


C 


c 


0 


A 


S 


B 


Z 


U 


G 


B 


U 


B 


B 


U 


H 


0 


V 


T 


P 


0 


7 


H 


I 


Z 


D 


E 


P 


Q 


F 


V 


K 


z 







































If we assume a period of 50, the cryptogram would be written out on this 
width, as illustrated below; the $ Q value for each column is obtained and 
is included in the diagram: 

112233^45 

5050505050 

HSKUSFMFHDUJJIXMSPTPOIPCIWKZVUYPPNEUSAIGBOOGAOPGPR 

HB0UCSHPVGHQXZSACKRKVBGHMVSFRYYTKHKVW2XVLIJHWARLKF 

XJSLmHKAHQUJVTXSMECFCSKTGOOYBXZVLIJRYACDWBJMSCAFP 

IEAXOKAQPWEXPYPQHDNOJIXNZJGNUDOARFUERJOYBrKSCEIKDUV 

TDVEVLETDOAFROUNYNBDVQpBEGGSHQHXOFUZCOCUKKZLTPHKRT 

CCOASBZUGBUBBUHOVTPOVMIZDEPQFVKZ 

40222020202000002002620002200022002020002020000002 

We note that there are 32 columns wherein K ■ 6, and 18 columns wherein 
N ■ 5; we also note that the $ values range between 0 and 6. In the dia- 
gram below, keeping the data from the two categories of H separate, the 
column labelled "6" is the observed value of 6; the column labelled N x n 



H ■ 6 
6i x I 
0 17 0 

2 13 26 
4 1 4 

6 16 
32 3 & 



N ■ 5 

6 I * I 

0 13 0 

2 5 10 

4 0 0 

6 0 0 

IF 10 



is the number of times the particular value of $ occurred; and the column 
labelled "6*" Is the product of the preceding two columns (given as a means 
of arriving at the average value of 6) . The average value of 6 (symbolized 
by which is read as "6 bar*) where H ■ 6 is 36, or 1.13; the ^ where 

32 

N s 5 is 10, or O.56; in other words, the average value of 6 is derived by 

lF 

adding up all the 60 values for a given column length, and then dividing by 



the number of columns of that length. The values of 7 are compared with 
~ 36 
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4>p and $j. below, and, since <j) more closely approximates than it does 
$p, the conclusion is reached that the period of the cryptogram is not 

50. 10 



♦ 

fe 



N ■ 6 


N • 5 


1.13 


O.56 


2.00 


1.33 


1.15 


0.77 



(2) Since ve have discarded 50 as a possible period, ve write the 
cryptogram on a width of 49 and examine its statistics; if this width falls, 
then we write the cryptogram on widths of k8, 47, ...etc. The results of 
assumptions of widths from k9 down to 44 are shown in the diagram below: 



49 alphabets 
N » 6 N ■ 5 


iTWnfll 


■noi 


1.57 


0.67 


1.33 


0.33 




2.00 


1.33 


2.00 


i.33 




1.15 


0.77 


1.15 


0.77 





46 alphabets 
N ■ 7 N ■ 6 


45 alphabets 
N ■ 7 N ■ 6 


44 alphabets 
n ■ 7 n • 6 


1.00 


1.15 


1.50 


0.69 


1.22 


1.23 


2.80 


2.00 


2.80 


2.00 


2.80 


2.00 


1.66 


1.15 


1.66 


1.15 


1.66 


1.15 



These assumed periods are discarded one by one because if did not come up 
to plaintext expectations. 



10 Kullback ibid . p 42, carries the analysis further by considering the slgmages of the deviations, 
and expresses these in terms of probability statements (assuming for convenience that this sigmage is nor- 
mally distributed) He shows that, for N = 6, only 15% of monoalphabetic text would yield a value of f 
as small as or smaller than 1 13, whereas 52% of random text would yield a value of ? as large as or larger 
than 1 13, for N =5, only 35% of monoalphabetic text would yield a value of $ as small as or smaller than 
0 56, whereas 75% of random text would yield a value of f as large as or larger than that observed This 
is more compactly Illustrated in the diagram below 



N =6 N =5 



<f, N letters of 
monoalphabetic text 

f, N letters of 
random text 



P«- 1 13) = 16 


P(f * 0 56) = 35 


P(5»l 13) = 52 


P($ *> 0 56) = 75 
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(3) Nov testing for a period of 43, ve write out the cryptogram on 
this width and take the of the columns, as is illustrated below: 

11223344 

505050503 

HSKUSPMFHDU JJ IXMSPTPO IPC IWKZVUYPPNEUS AIGBOO 

GAOPGFRHBOUCSHFVGHQXZSACKRKVBGHMVSFRYYTKHKV 

WZXVLIJHWARLKFIJSLTMHKAHQTUVTXSMECFCSKTCOOY 

BXZVLIJRYACDWEJMSCAFPIEAXOKAQDWEXFYPQHDNOJI 

XNZJGNUDOARFUERJOYBDOKEIKDUVTDVEVLETDOAFROU 

NYHBDVQOBEGGSHQHXOPUZCOCUKKZLTPHKRTCCOASBZU 

GBUBBUNOYTPOVKIZDEPQFVKZ 

20244424264024246040444620*8220420422242462 



The data from this hypothesis are tabulated in the following diagram: 



■ 




■ 


1 






0 




0 


2 




12 


4 


11 


44 


6 


2^ 


18 

7* 



* 


N s 

X 


> 

4 * 




mm 


Ml 






E] 




u 


El 




n 


6 


8 


D 


8 


14 


H 


14 




19 


52 



? s • 3.08 



£ ■ 62 ■ 3.26 
19 



The comparison of the ^ values with the values for and 4r is illustrated 
in the following diagram: 





N a 7 


N a 6 


4> 


3.08 


3.26 




2.80 


2.00 


Jr 


1.66 


1.15 



There seems to be no doubt that the period of the cryptogram is 43* 

(4) In this example, it is noted that 6 counts were made of the 
columns of the write-outs of the cryptogram on the various widths, in this 
case, $'s are more convenient to use than their translation in terms of the 
decimal values of I.C.'s. If however ve had much longer columns, the I.C. 
values might give a quicker portrayed of the relative goodness of the col- 
umns. Note that ve could have used I.C.'s in expressing the final result 
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of each assumption of a period, as follows: 



50 alphabets 
N ■ 6 N • 5 


49 alphabets 
N ■ 6 N ■ 5 


48 alphabets 
K » 6 N ■ 5 


47 alphabets 
N • 6 


0.98 0.73 


1.37 O .87 


1.16 0.43 


0.74 



46 alphabets 
N * 7 N « 6 


45 alphabets 
N a 7 N * 6 


44 alphabets 
N a 7 N a 6 


43 alphabets 
N * 7 N a 6 


0.60 1.00 


0.90 0.60 


0.73 1*07 


1.86 2.83 



It will he observed that the data may he evaluated much more rapidly in 
the case of I.C.'s, since ve need to keep only one invariant index (1.73) 
in mind in comparing our results with the expected value of the I.C. for 
English plain text. 



11 In the calculations of this problem Kullback treated the statistics for the long and short columns 
separately, this was done primarily to make easier the determination of the sigmages of the deviations 
However, it is possible to derive a single statistic (either d or I C ) for each hypothesis of a period, 
eliminating the necessity of looking at two sets of data for each assumption of a period 

For instance m the hypothesis of SO alphabets, the total number of comparisons is 32^6x5j+ 18 ^5x4^ = 660 

thus the $ values (which by definition are twice the expected number of coincidences) are the following 

4jp = 2(660X 0667) = 88 
4k = 2(660X 0385) = 51 

The observed tp Is the sum of the {> values for the long and short columns, so that ^ = 36 + 10 = 46 The 
I C is thus 46 = 0 90 
51 

In the hypothesis of 43 alphabets, the number of comparisons is 24^7x6 j + 19 ^ 6x5j , thus 

$p = 2(789) = 105 
15 

4k = 2(789) = 61 
26 

4> 0 = 74 + 62 = 136 

The 1 C of 136 = 2 23 points to this hypothesis as the correct period (Note that 0667 is approximately 
61 

equal to so that computation is facilitated by using _1_ and 1_ instead of 0667 and 0385 for the plain 
15 15 26 

text and random constants respectively ) 

Having established the period as 43 solution of this example is predicated on the assumption that 
standard alphabets are involved, this procedure will be taken up in par 21 m the next chapter 
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19 » Third step: solving the monoalphabetic distributions . — The dif- 

ficulty experienced in analyzing the individual or isolated frequency dis- 
tributions depends mostly upon the type of cipher alphabets that is used. 

It is apparent that mixed alphabets may be used just as easily as standard 
alphabets, and, of course, the cipher letters themselves give no indication 
as to vhich is the case. However , just as it was found that in the case of 
monoalphabetic substitution ciphers, a uniliteral frequency distribution 
gives clear indications as to whether the cipher alphabet is a standard or a 
mixed alphabet, by the relative positions and extensions of the crests and 
troughs in the table, so it is found that in the case of repeating -key 
ciphers, unlllteral frequency distributions for the Isolated or individual 
alphabets will also give clear indications as to whether these alphabets 
are standard alphabets or mixed alphabets. Only two or three such fre- 
quency distributions are necessary for this determination; 12 if they appear 
to be standard alphabets, similar distributions can be made for the rest of 
the alphabets; but if they appear to be mixed alphabets, then it is best to 
compile triliteral frequency distributions for all the alphabets. The analy- 
sis of the values of the cipher letters in each table proceeds along the 
same lines as in the case of monoalphabetic ciphers. The analysis is more 
difficult only because of the reduced size of the tables, but If the message 
be very long, then each frequency distribution will contain a sufficient 
number of elements to enable a speedy solution to be achieved. 



12 

In certain mixed-alphabet periodic ciphers, it is possible that a distribution for one alphabet might 
reflect the phenomena expected for a standard alphabet, for instance, if the plain- and cipher components 
are identically -mixed sequences running In the same direction, and if for one alphabet Ap = then the 

distribution for that alphabet will be the normal unlllteral distribution It is for this reason that we must 
make distributions for at least two alphabets to determine whether or not a polyalphabetic cipher is com- 
posed of standard alphabets 
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Table of Factors 
Numbers 1-400 Inclusive 



1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 



2 

2 3 

2 4 

3 

2 5 

2 3 4 6 

2 7 

3 5 

2 4 8 

2 3 6 9 

2 4 5 10 

3 7 
2 11 

2 3 4 6 8 12 
5 

2 13 

3 9 

2 4 7 14 
2 3 5 6 10 15 

2 4 8 16 

3 11 
2 17 
5 7 

2 3 4 6 9 12 18 

2 19 

3 13 

2 4 5 8 10 20 
2 3 6 7 14 21 

2 4 11 22 

3 5 9 15 
2 23 

2 3 4 6 8 12 16 24 
7 

2 5 10 25 



51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 



67 

68 

69 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

80 
81 

82 

83 

84 

85 

86 

87 

88 

89 

90 

91 

92 

93 

94 

95 

96 

97 

98 

99 
100 



3 17 

2 4 13 26 
2 3 6 9 18 27 

5 11 

2 4 7 8 14 28 

3 19 
2 29 

2 3 4 5 6 10 12 15 20 30 

2 31 

3 7 9 21 

2 4 8 16 32 
5 13 

2 3 6 11 33 

2 4 17 34 

3 23 

2 5 7 10 14 35 
2 3 4 6 8 9 12 18 24 36 

2 37 

3 5 15 25 
2 4 19 38 
7 11 

2 3 6 13 26 39 

2 4 5 8 10 16 20 40 

3 9 27 
2 4i 

2 3 4 6 7 12 i4 21 28 42 
5 17 

2 43 

3 29 

2 4 8 11 22 44 

2 3 5 6 9 10 15 18 30 45 
7 13 

2 4 23 46 

3 31 
2 47 
5 19 

2 3 4 6 8 12 16 24 32 48 
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2 7 l4 49 

3 9 11 33 

2 4 5 10 20 25 50 
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101 

102 

103 

104 

105 

106 

107 

108 

109 

110 
111 
112 

113 

11 4 

115 

116 

117 

118 

119 

120 

121 

122 

123 

124 

125 

126 

127 

128 
129 

130 

131 

132 

133 

134 

135 

136 

137 

138 

139 

1 4 0 

1 4 1 

142 

143 

144 

145 

146 
14 ? 

148 

149 

150 



2 3 6 17 34 51 

2 4 8 13 26 52 

3 5 7 15 21 35 
2 53 

2 3 4 6 9 12 18 27 36 5 ^ 

2 5 10 ll 22 55 

3 37 

2 4 7 8 14 16 28 56 

2 3 6 19 38 57 
5 23 

2 4 29 58 

3 9 13 39 
2 59 

7 17 

2 3 4 5 6 8 10 12 15 20 24 30 
40 60 

11 

2 61 

3 4 i 

2 4 31 62 
5 25 

2 3 6 7 9 14 18 21 42 63 

2 4 8 16 32 64 

3 43 

2 5 10 13 26 65 

2 3 4 6 11 12 22 33 44 66 
7 19 

2 67 

3 5 9 15 27 45 
2 4 8 17 34 68 

2 3 6 23 46 69 

2 4 5 7 10 14 20 28 35 70 

3 47 
2 71 
11 13 

2 3 4 6 8 9 12 16 18 24 36 
48 72 
5 29 

2 73 

3 7 21 49 
2 4 37 74 

2 3 5 6 10 15 25 30 50 75 
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151 

152 

153 

154 

155 

156 

157 

158 

159 

160 

161 

162 

163 

1 64 

165 

1 66 

167 

168 

169 

170 

171 

172 

173 

174 

175 

176 

177 

178 

179 

180 

181 

182 

183 

184 

185 

186 

187 

18 8 

189 

190 

191 

192 

193 

194 

195 

196 

197 

198 

199 

200 



2 4 8 19 38 76 

3 9 17 51 

2 7 11 14 22 77 
5 31 

2 3 4 6 12 13 26 39 52 78 

2 79 

3 53 

2 4 5 8 10 16 20 32 40 80 
7 23 

2 3 6 9 18 27 54 81 

2 4 4 l 82 

3 5 11 15 33 55 
2 83 

2 3 4 6 7 8 12 14 21 24 28 42 
56 84 
13 

2 5 10 17 34 85 

3 9 19 57 
2 4 43 86 

2 3 6 29 58 87 
5 7 25 35 

2 4 8 11 16 22 44 88 

3 59 
2 89 

2 3 4 5 6 9 10 12 15 18 20 30 
36 45 60 '90 

2 7 13 14 26 91 

3 61 

2 4 8 23 46 92 
5 37 

2 3 6 31 62 93 
11 17 

2 4 47 94 

3 7 9 21 27 63 
2 5 10 19 38 95 

2 3 4 6 8 12 16 24 32 48 64 96 

2 97 

3 5 13 15 39 65 

2 4 7 i 4 28 49 98 

2 3 6 9 11 18 22 33 66 99 
2 4 5 8 10 20 25 40 50 100 
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201 


3 67 


252 


2 3 4 6 7 9 12 14 18 21 28 36 42 


202 


2 101 




63 84 126 


203 


7 29 


253 


11 23 


204 


2 3 4 6 12 17 34 51 68 102 


254 


2 127 


205 


5 4 i 


255 


3 5 15 17 51 85 


206 


2 103 


256 


2 4 8 16 32 64 128 


207 


3 9 23 69 


257 


2 3 6 43 86 129 


208 


2 4 8 13 16 26 52 104 


258 


209 


11 19 


259 


7 37 


210 


2 3 5 6 7 10 l 4 15 21 30 35 42 


260 


2 4 5 10 13 20 26 52 65 130 




70 105 


261 


3 9 29 87 


211 




262 


2 131 


212 


2 4 53 106 


263 




213 


3 71 


264 


2 3 4 6 8 11 12 22 24 33 44 66 


2 l 4 


2 107 




88 132 


215 


5 43 


265 


5 53 


2l6 


2 3 4 6 8 9 12 18 24 27 36 54 


266 


2 7 l 4 19 38 133 




72 108 


267 


3 89 


217 


7 31 


268 


2 4 67 134 


218 


2 109 


269 


2 3 5 6 9 10 15 18 27 30 45 54 


219 


3 73 


270 


220 


2 4 5 10 11 20 22 44 55 110 




90 135 


221 


13 17 


271 




222 


2 3 6 37 74 ill 


272 


2 4 8 16 17 34 68 136 


223 




273 


3 7 13 21 39 91 


224 


2 4 7 8 14 16 28 32 56 112 


274 


2 137 


225 


3 5 9 15 25 45 75 


275 


5 11 25 55 


226 


2 113 


276 


2 3 4 6 12 23 46 69 92 138 


227 




277 




228 


2 3 4 6 12 19 38 57 76 114 


278 


2 139 


229 




279 


3 9 31 93 


230 


2 5 10 23 46 115 


280 


2 4 5 7 8 10 14 20 28 35 40 56 


231 


3 7 11 21 33 77 




70 i 4 o 


232 


2 4 8 29 58 116 


281 




233 




282 


2 3 47 94 l 4 l 


234 


2 3 6 9 13 18 26 39 78 117 


283 




235 


5 47 


284 


2 4 71 142 


236 


2 4 59 118 


285 


3 5 15 19 57 95 


237 


3 79 


286 


2 ll 13 22 26 143 


238 


2 7 14 17 34 119 


287 


7 4 i 


239 




288 


2 3 4 6 8 9 12 16 18 24 32 36 


240 


2 3 4 5 6 8 10 12 15 16 20 24 30 




48 72 96 144 




40 48 60 80 120 


289 


17 


24 l 




290 


2 5 10 29 58 145 


242 


2 11 22 121 


291 


3 97 


243 


3 9 27 81 


292 


2 4 73 i 46 


244 


2 4 6l 122 


293 




245 


5 7 35 49 


294 


2 3 6 7 14 21 42 49 98 147 


246 


2 3 6 4 i 82 123 


295 


5 59 


247 


13 19 


296 


2 4 8 37 74 148 


248 


2 4 8 31 62 124 


297 


3 9 ll 27 33 99 


249 


3 83 


298 


2 149 


250 


2 5 10 25 50 125 


299 


13 23 


251 




300 


2 3 4 5 6 10 12 15 20 25 30 50 6e 
75 100 150 
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301 


7 43 


352 


2 4 8 ll 16 22 32 44 88 176 


302 


2 151 


353 




303 


3 101 


354 


2 3 6 59 118 177 


304 


2 4 8 16 19 38 76 152 


355 


5 71 


305 


5 61 


356 


2 4 89 178 


306 


2 3 6 9 17 18 34 51 102 153 


357 


3 7 17 21 51 119 


307 




358 


2 179 


308 


2 4 7 11 l 4 22 28 44 77 154 


359 




309 


3 103 


360 


2 3 4 5 6 8 9 10 12 15 18 20 24 


310 


2 5 10 31 62 155 




30 36 40 45 60 72 90 120 180 


311 




361 


19 


312 


2 3 4 6 8 12 13 24 26 39 52 78 104 


362 


2 181 


313 




363 


3 11 33 121 


314 


2 157 


364 


2 4 7 13 14 26 28 52 91 182 


315 


3 5 7 9 15 21 35 45 63 105 


365 


5 73 


316 


2 4 79 158 


366 


2 3 6 6l 122 183 


317 




367 




318 


2 3 6 53 106 159 


368 


2 4 8 16 23 46 92 184 


319 


11 29 


369 


3 9 4 i 123 


320 


2 4 5 8 10 16 20 32 4 o 64 80 160 


370 


2 5 10 37 74 185 


321 


3 107 


371 


7 53 , . _ 


322 


2 7 14 23 46 161 


372 


2 3 4 6 12 31 62 93 124 186 


323 


17 19 


373 




324 


2 3 4 6 9 12 18 27 36 54 81 


374 


2 11 17 22 34 187 




108 162 


375 


3 5 15 25 75 125 


325 


5 13 25 65 


376 


2 4 8 47 94 188 


326 


2 163 


377 


!3 29 „ 


327 


3 109 


378 


2 3 6 7 9 14 18 21 27 42 54 63 126 


328 


2 4 8 4 i 82 164 


379 




329 


7 47 


380 


2 4 5 10 19 20 38 76 95 190 


330 


2 3 5 6 10 11 13 22 30 33 55 66 


381 


3 127 




110 165 


382 


2 191 


331 




383 




332 


2 4 83 166 


384 


2 3 4 6 8 12 16 24 32 48 64 96 128 


333 


3 9 37 ill 


385 


5 7 11 35 55 77 


334 


2 167 


386 


2 193 


335 


5 67 


387 


3 9 43 129 


336 


2 3 4 6 7 8 12 14 16 21 24 28 42 48 


388 


2 4 97 194 




56 84 112 168 


389 i 




337 




390 


2 3 5 6 10 13 15 26 30 39 65 78 


338 


2 13 26 169 




130 195 


339 


3 113 


391 


17 23 


340 


2 4 5 10 17 20 34 68 84 170 


392 


2 4 7 8 i 4 28 49 56 98 196 


34 l 


11 31 


393 


3 131 


342 


2 3 6 9 18 19 38 57 114 171 


394 


2 197 


343 


7 49 


395 


5 79 


344 


2 4 8 43 86 172 


396 


2 3 4 6 9 11 12 18 22 33 36 44 


345 


3 5 15 23 69 115 




66 99 132 198 


346 


2 173 


397 




347 




398 


2 199 


348 


2 3 4 6 12 29 58 87 116 174 


399 


3 7 19 21 57 133 


349 




400 


2 4 5 8 10 16 20 25 40 50 80 


350 


2 5 7 10 14 25 35 50 70 175 




100 200 


351 


3 9 13 27 39 117 
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CHAPTER IV 

REPEATING -KEY SYSTEMS WITH STANDARD CIPHER ALPHABETS 

Paragraph 



Solutionby applying principles of frequency 20 

Solution by completing the plain -component sequence 21 

Solution by the "probable-word method" 22 

The Porta system 23 

The Gronsfeld system 24 

Polyalphabetic numerical systems . 25 



20. Solution by applying principles of frequency. — a. In the light 
of the foregoing principles, let the following cryptogram be studied: 

Message 

5 10 15 20 25 

A. A U K H Y JAMKI ZYMWM JMIGX NFMLX 

B. ETIMI ZHBHR AYMZM ILVM E J K UTG 

C. D P V X K Q U K H Q LHVRM JAZNG GZVXE 

D. N LUFM PZJNV C H U A S H K Q G K I P L W P 

E. A J Z X I G U M T V D PTE J ECMYS QYBAV 

F. ALAHY POIXW PVNYE EYXEE UDPXR 

G. BVZVI ZIIVO S PTE G KUBBR QLLXP 

H. W F QGK NLLLE PTIKW D J Z X I G OIOI 

J. Z L A MV KFMWF NPLZI OVVFM ZKTXG 

K. NLMDF A A E X I J LUFM PZJNV C A I G I 

L. UAWPR NVIW E J K Z A S Z L A F M H S 



All repetitions of trigraphs and longer polygraphs are underlined, these 
repetitions are tabulated in the diagram below, together with their loca- 
tions, intervals, and factors. 



Repetition 


Location 


Interval 


Factors 


LUTMPZJNVC 


D2, KL2 


160 


2, 4, 5, 8, 10, 16, 20, 32, 40, 80 


JZXIG 


E2, HIT 


90 


2, 3, 5, 6, 9, 10, 15, 18, 30, 45 


EJK 


B20, L10 


215 


5, 43 


PTE 


E12, G12 


50 


2, 5, 10, 25 


QGK 


D18, H3 


85 


5, 17 


UKH 


A2, C7 


55 


5, 11 


ZLA 


Jl, L16 


65 


5, 13 
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b. The factor 5 appears in all cases; it is practically certain that 
the nukber of alphabets is five, and the l.C.'s should confirm this hypothe- 
sis. Since the text already appears in groups of five letters, it is un- 
necessary to rewrite the message. The next step is to make a uniliteral 
frequency distribution for Alphabet 1 to see if it can be determined whether 
or not standard alphabets are involved. It is as follows: 

Alphabet 1 

^ - «= S m 2 ■ a ^ _ 0-03 - - - 0 

ABCDEFGHIJKLMNOPQRSTUVWXYZ I.C. * 1.44 

c. Although the indications for fitting the distribution to the nor- 
mal are not very clear cut, yet if one takes into consideration the small 
amount of data, the assumption of a direct standard alphabet with W c * Ap, 
is worth further test. Accordingly a similar distribution is made for 
Alphabet 2. 

Alphabet 2 

3 

0 - = s _ = s _ = 0 _ = ia Ss 

ABCDEFGHIJKLMNOPQRSTUVWXYZ I.C. * 1.4? 

d. There is every indication of a direct standard alphabet, with 
H c * Ap. Let similar distributions be made for the last three alphabets. 
They are as follows: 

Alphabet 3 

ss = !== = §!_ s S 0 0 

ABCDEFGHIJKLMNOPQRSTUVWXYZ I.C. ■ 1.71 

Alphabet 4 

S 

2 _ _ S S S S b a 5 £ — a a £ £ a a 

ABCDEFGHIJKLMNOPQRSTUVWXYZ I.C. ■ 1.36 

Alphabet 5 

ial 0-5 ! -b- 3S ^aaa 

ABCDEFGHIJKLMNOPQRSTUVWXYZ I.C. * 1.91 




PDNFIBHNKAI. — 
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e. After but little experiment it is found that the distributions can 
best be made to fit the normal when the following values are assumed: 

Alphabet 1.. Ap - W c 

Alphabet 2 Ap ■ He 

Alphabet 3 Ap - I c 

Alphabet 4 Ap ■ 7c 

Alphabet 5 Ap = E c 

f . Note the key word given by the successive equivalents of Apt WHITE. 
And also note what may appear to be a discordant note in the values of three 
of the I.C.'s above. 1 Nevertheless, the real proof of the cryptanalytic 



* As has been remarked in subpar 17b small deviations from the expected values are usual and in fact may 
be anticipated, whereas large deviations are rare In the case of the I C 's at hand the value for the third 
alphabet (1 71) almost coincides with the expected 1 73 bur the values for the 1st 2d and 4th alphabets seem 
too low while the value for the 5th (1 91) is "on the high side", i e , a positiv e deviation instead of a nega- 
tive deviation For the benefit of the mathematical reader these deviations from the expected plain can be 
proven to be in the nature of only about 1CJ for samples of the se size s (65 and 54 tallies), so that the devia- 
tions observed are not really significant after all For the statistically curious the formulas for the standard 
deviation of <p and 1 C for English plain text are given below (where N is the sample size) 

<5 (*) =^( 0048)N 3 + ( 110I)N 2 + ( 1149)N 



<J (L C ) = -~- 
(N- 

Derivation of these formulas will be left for the extensive treatment of cryptomathematics in Military 
Cryptanal ytics, Part III It might be noted that cryptanalysts are usually much more deeply concerned with 
the deviation of an observed $ or 1 C from random rather from an estimated or expected plain This is of 
course especially true in situations wherein the value of the is unknown (such as would be in the case of 
a 10x10 bipartite matrix of unknown composition or m the case of a polyalphabetic encipherment of an un- 
known code), in such situations only the deviations from r andom could be measured The formulas for the 
standard deviation of $ and I C for 26 letter random text are as follows 

ff (if) = 2720 VN(N-l) 

0(1 C ) = 7 0711 

Vn(N-I) 

Since sigmage is defined as the difference between the observed and the expected number divided by the 
standard deviation it may be shown that the 1 C of Alphabet 1 in the example is 1 44 - 1 00 = 3 38 S over 

13 

random, for this type of distribution (which follows the*^ distribution) this amounts to less than 1 chance in 
300 of being produced at random 



- - -r=— ~\k 0D48)N2 +( 1101)N 
1)Vn V • 



- 1149 



4? 
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pudding (i.e. , the correctness of the analysis) Is, of course, to test the 
values of the solved alphabets on the cryptogram. The five complete cipher 
alphabets are as follows: 

Plain text 



1 

2 

3 

4 

5 



ABCDEFGHIJKLMNOPQRSTUV W X Y Z 



w 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


T 


u 


V 


w 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q. 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 



g. Applying these values to the first few groups of our message, the 
following is found: 

12345 12345 12345 12345 12345 

Cipher. . .AUKHY JAMKI ZYMWM JMIGX NFMLX... 

Plain ENCOU NTEBE DREDI NFANT RYEST... 

h. Intelligible text at once results, and the solution can now be 
completed very quickly. The complete message is as follows: 

ENCOUNTERED RED INFANTRY ESTIMATED AT ONE REGIMENT AND MACHINE GUN 
COMPANY IN TRUCKS NEAR J3MIT3BURG. AM HOLDING MIDDLE CREEK NEAR HTT.L 543 
SOUTHWEST OF FAIRPLAY. WHEN FORCED BACK WILL CONTINUE DELAYING REDS AT 
MARSH CREEK. HAVE DESTROYED BRIDGES ON MIDDLE CREEK BETWEEN EMMITSBURG- 
TANEYTOWN ROAD AND RHODES MILL. 

1 . In the foregoing example (which is typical of the system erroneously 
attributed, in cryptographic literature, to the French cryptographer Vigenere, 
although to do him Justice, he made no claim of having "invented" it), direct 
standard alphabets were used, but it is obvious that reversed standard al- 
phabets may be used and the solution accomplished in the same manner. In 
fact , the cipher disk once used by the United StateB Army tor a number of 
years yields exactly this type of cipher, which is also known in the liter- 
ature as the Beaufort Cipher, and by other names. In fitting the isolated 
frequency distributions to the normal, the direction of "reading” the crests 
and troughs is merely reversed. 2 

21. Solution by completing the plain-component sequence. — a. There is 
another method of solving this type of cipher, which is worthwhile explaining, 
because' the underlying principles will be found useful in many cases. It is 
a modification of the method of solution by completing the plain-component 
sequence, already explained in Military Cryptanalytics , Part I . 

b. After all, the individual alphabets of a cipher such as the one 
Just solved are merely direct standard alphabets. It has been seen that 
monoalphabetlc ciphers in which standard cipher alphabets are employed may 



2 If standard alphabets are employed wherein a letter (usually J) is omitted, this omission must be taken 
into consideration in fitting the distributions to the normal, or in applying the method of completing the 
plain-component sequence treated in par 21 ,0 
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be solved almost mechanically by completing the plain-component sequence. 
The plain text reappears on only one generatrix and this generatrix is 
the same for the whole message. It is easy to pick this generatrix out 
of all the other generatrices because it is the only one which yields 
intelligible text. Is it not apparent that if the same process is applied 
to the cipher letters of the individual alphabets of the cipher just 
solved that the plaintext equivalents of these letters muBt all reappear 
on one and the same generatrix? But how will the generatrix which actual- 
ly contains the plaintext letters be distinguishable from the other gen- 
eratrices, since these plaintext letters are not consecutive letters in 
the plain text but only letters separated from one another by a constant 
interval? The answer is simple. The plaintext generatrix should be 
distinguishable from the others because it will shew more and a better 
assortment of high-frequency letters, and can thus be selected by the eye 
from the whole set of generatrices . If this Is done with all the alphabets 
in the cryptogram, it will merely be necessary to assemble the letters of 
the thus selected generatrices in proper order, and the result should be 
consecutive letters forming intelligible text. 

c. An example will serve to make the process clear. Let the same 
message be used as before. Factoring showed that it Involves five alpha- 
bets. Let the first ten cipher letters in each alphabet be set down in 
a horizontal line and, under the assumption that direct standard alphabets 
are involved, let the normal alphabet sequences be couple ted. 3 Thus: 



3 If reversed standard alphabets are assumed it would first be necessary to convert the cipher letters 
of each isolated alphabet into their normal plain-component equivalents, and then to proceed as m the 
case of direct standard alphabets 
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Alphabet 1 


Alphabet 2 


Alphabet 3 


Alphabet 4 


Alphabet 5 


1 


AJZJKEZAIJ 


UAYMFTHYLK 


KMUMIBMVU 


HKWGLMHZMT 


YIMXXIRMEG 


2 


BKAKOFABJK 


VBZNGUIZKL 


LNKJNJCNWV 


ILXHMNIANU 


ZJNYYJSNFH 


3 


CLBLPGBCKL 


WCAOHVJANM 


MOOKOKDOXW 


JMYINOJBOV 


AKOZZKTOGI 


4 


DMCMQHCDLM 


XDBPIWKBOH 


NPPLPLEPYX 


KHZJOPKCPW 


BLPAALUPHJ 


5 


ENDNRIDEMN 


YECQJXLCFO 


OQQMQMFQZY 


LOAKPQLDQX 


CMQBBMVQIK 


6 


F0E0SJEFN0 


ZFDRKYMDQP 


PRRHRHGRAZ 


MPBLQRMERY 


DNRCCNWRJL 


7 


GPFPBCFGOP 


AGESLZHERQ 


QSSOSOHSBA 


NQCMRSNFSZ 


EOSDDOXSKM 


8 


HQGQULGHPQ 


BHFTMAOFSR 


RTTPTPITCB 


QRDNSTOGTA 


FPTEEPYTLN 


9 


IRHRVMHIQR 


CIGUHBPGTS 


SUUQUQJUDC 


PSEOTUPHUB 


GQUFFQZUMO 


10 


JSISWNIJRS 


DJHVOCQHUT 


TWRVRKVED 


QTFPUVQJVC 


HRVGGRAVNP 


11 


KTJTXOJKST 


EKIWPDRIVU 


UWWSWSLWFE 


HUGQVWRJWD 


ISWHHSBWOQ 


12 


LUKUYPKLTU 


FLJXQESJWV 


VXXTXTMXGF 


SVHRVfXSKXE 


JTXIITCXPR 


13 


MVLV2QJJ4UV 


GMKYRFTKXW 


WYYUYUNYHG 


WISXYTLYF 


KUYJJUDYQS 


14 


HWMWARMNVW 


HNLZSGULYX 


XZZVZVOZIH 


UXJTYZUMZG 


LVZKKVEZRT 


15 


OXHXBSNOWX 


IOMATHVMZY 


YAAWAWPAJI 


VYKUZAVNAH 


MWALLWFASU 


16 


fyoyctopxy 


JPWBUIWHAZ 


ZBBXBXQBKJ 


WZLVABWOBI 


NXBMMXGBTV 


17 


QZPZDUPQJZ 


KQOCVJXOBA 


ACCYCYRCLK 


XAMWBCXPCJ 


OYCNNYHCUW 


18 


RAQAEVQRZA 


LRPDWKTPCB 


BDDZDZSDML 


YBNXCDYQPK 


PZDOOZIDVX 


19 


SBRBIWRSAB 


HSQEXLZQPC 


CEEAEATENM 


ACOYDEZEEL 


QAEPPAJEWY 


20 


TCSCGXSTBC 


NTRFYMARED 




ADPZEFASFM 


RBFQQBKFXZ 


21 


UDTDHYTUCD 


OUSGZNBSFE 


EGGCGCVGPO 


BEQAFGBTGN 


SCGRRCLGYA 


22 


VEUEIZUVDE 


FVTHAOCTGF 


FHHDHDWBQP 


CFRCGHCUHD 


TDHSSDMHZB 


23 


WFVFJAVWEF 


QMUIBPDUHG 


GIIEIEXIRQ 


DGSCHIDVIP 


UEITTENIAC 


24 


XGWGKBWXFG 


RXVJCQEVIH 


HJJFJFYJSR 


EHTDIJEWJQ 


VFJUUFOJBD 


25 


YHXHLCXYGH 


SYWKDRFWJI 


IKKGKGZKTS 


FIUEJKFXKR 


WGKWGPKCE 


26 


ZIYMDYZHI 


TZXLESGXKJ 


JLLHLHALUT 


GJVFKLGYLS 


XHLWWHQLDF 



Figure 13. 



d. If the high-frequency generatrices underlined in Fig. 13 are 
selected and their letters are juxtaposed in columns, the consecutive 
letters of intelligible plain text immediately present themselves. Thus: 



For Alphabet 1, 
For Alphabet 2, 
Selected Generatrices-I For Alphabet 3 , 

For Alphabet 4, 
For Alphabet 5 , 



generatrix ^...ENDNR ID£HS 
generatrix 20. .N T R F Y M A R E D 
generatrix 19 . .CEEAEATENM 
generatrix 8...0 RDSSTOGTA 
generatrix 23..U E I T T E H I A C 



Columnar juxtaposition of letters 
from selected generatrices 



1 2 3 4 5 

"ESCOU 
N T E R E 

DREDI 
N F A H T 

RYEST 
I M A T E 

DAIOli 
EREGI 
HENIA 
N D M A C 
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Plain text: ENCOUNTERED RED INFANTRY ESTIMATED AT ONE 

REGIMENT AND MAC . . . 

e. Solution by this method can thus be achieved without the compil- 
ation - ^ any frequency tables whatever and is very quickly attained. The 
inexperienced cryptanalyst may have difficulty at first in selecting the 
generatrices which contain the most and the best assortment of high-fre- 
quency letters, but with increased practice, a high degree of proficiency 
is attained. After all it is only a matter of experiment, trial, and 
error to select and assemble the proper generatrices so as to produce in- 
telligible text. The ocular selection of the correct generatrix in each 
alphabet may be narrowed down to a considerably restricted choice from 

a comparatively few generatrices, using a short-cut procedure which has 
much merit and is easy to apply, as will now be demonstrated. 

f. Let the generatrices be completed as in Fig. 13, and then let us 
encircle all the letters J, K, Q, X, and Z in each of the ten columns 
belonging to Alphabet 1. Now let us cross out all generatrices contain- 
ing two or more of these low-frequency letters, under the premise that 

it is unlikely that the correct generatrix will contain more than one of 
these low-frequency letters. 4 This procedure is extended to the genera- 
trices pertaining to Alphabets 2-5 (cf. Fig. 14) . It will be observed 
that with this procedure there have been eliminated 13, 15 , 11, 16, and 
16 generatrices from Alphabets 1-5, respectively, thus considerably 
simplifying the Inspection of the remaining generatrices. 

£. The selection of the correct generatrix from those remaining may 
now be facilitated by the use of a rough weighting or "scoring" procedure, 
in which the eight highest -frequency letters (ETNROAIS) are assigned a 
weight of 1 and the remaining letters a weight of 0. 5 The sum of the 



4 This premise can be substantiated statistically By means of the binomial theorem, it may be shown 
that for 10-letter generatrices an average of 60% (i e 16 generatrices out of 26) of incorrect generatrices 
will be eliminated while the chance of re ecting the correct case is only 0 8 % If the generatrices con- 
tained 15 letters an average of 82% (i e 21 out of 26) of incorrect generatrices may be expected to be 
eliminated With a risk of 1 8% as the chance of rejecting the correct case Thus to avoid excessive risk 
the threshhold of onl\ 2 letters of the JKQXZ group should be raised when the generatrices contain more 
than 12-15 letters 

^ In considering the h ghest frequency English plaintext letters m descending frequencj order there is a 
sharp drop after the S, therefore this seems the obvious place to divide the letters into two classes or cate- 
gories There are also other more cogent mathematical reasons to substantiate the fact that this 8-18 split is 
the best possible division of the English plaintext letters into two classes for weighting purposes The scoring 
system discussed actually involves t hree weights 1 0, and the elimination of generatrices on the basis 
of two or more occurrences of one of the low freqiency letters (JKQXZ) is tantamount to assigning a weight 
of -«» to the eliminated generatrices 

The set of alphabet str ps prepared for use in connection with the courses in Military Cryptanalyt’cs has 
been designed with this weighting system in mind The letters ETNROAIS are printed in red the rest of the 
letters in black with the letters JKQXZ in minuscule type Thus m using these strips one searches for the 
most redness in the generatrices discounting those generatrices m which two or more of the minuscLle 
letters are present 
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veights for each generatrix is then recorded at the side of the genera- 
trix; the correct generatrix may be expected to have the highest or near- 
highest score in that particular alphabet. The result of the generatrix 
elimination and the svuming of the veights is shown in Fig. 14, below: 

Alphabet 1 Alphabet 2 Alphabet 3 Alphabet 4 Alphabet 5 



1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 



AJZJHS&A1J 
BKAKO F A B J S 
0 CLBLPGBCKL 
0 DMCMQHCDLM 
7 ENDNRIDEMN 
7 F0E0SJEFN0 

2 GPFPTKFGOP 
g q p q ULGHPQ 

5 IRHRVMHIQR 
■ JBI S WHURB 
KTj qs c e jKST 
- LUKinrPKLTU 
MVLVa^LWJV 

4 NWMWARMNVW 
OXIB ffiS HO M X 

3 PYOYCTOPXY 
■■ QgPZDHPQYZ 

RAQAEVQRZA 

5 SBRBFWRSAB 

4 TCSGGXSTBC 
2 UDTDHYTUCD 
4 VEUEIZUVDE 
2 WFVFJAVWEF 

- K flW QKBWXFQ 

YHXHLCXYOH - 

ZIYIMDYZK - 



2 UAYMFTHYLK 

VBZ ws uia g. 

4 WCAOHVJANM 
XPBP1WKB0 M- 
YEGQJXLCPO 
-ZFDHKYMDQP 
AGESLZMERfr 

5 BHFTMAOFSR 
4 CIGUNBPGTS 

DJHVOCQHUT 
4 EKIWPDRIVU 
- FLJXQE S JWV 
- GMHHFTKXW - 
HHLZSGULYX - 

4 IOMATHVMZY 
- JPHBUIWHAZ 
- KQOGVJXOBA 

1 LRPDWKYPCB 
- M B QEXLZQDO 

6 NTRFYMARED 

5 OUSGZHBSFE 
4 PVTHAOCTGF 
1 QrfUIBFDUHG 

-MWffeWiH- 

-B YWKBRFWJI 

TZXLESQXK J- 



2 KMMIMIBMVU 
LNNJNJOHWV 
MOOKOKDOXW 

2 NPPLPLEPYX 

7 PRRNRNGRAZ 

7 QSSOSOHSBA 
6 RTTPTPITCB 

-6 UUQUQJUD0 

4 TVVRVRKVED 

3 UWWSWSLWFE 
- VXXTXMXGF 

1 WYYUYURYHG 
- XZZYZVOZIH 

5 YAAWAWPAJI 
- Z B EXBXQ3KJ 

2 ACCYCYRCLK 
-B DBZDZ 6 BML 

8 CEEAEATEHM 
2 DFFBFBUFON 
2 EGGCGCVGPO 
0 FHHDHDWHQP 

- QIXBIBXIBQ 
-S JJFJFYJSR 
^KKGKGZKTS 
2 JLLHLHALUT 



ffiWGLMHZ Mg- 
5 ILXHMNIANU 
JMYIMOJBOV 
KHZJOPKOFW 
LOAKP^LD^X - 

3 MPBLQRMERY 
-NQ S Iffi SKF S Z 

8 ORDNSTOGTA 

4 PSEOTUPHUB 
QTFPUVQIVC - 
RUGQVWRJWD 
-S VHRWX S KXE 

3 WISXYTLYF 
- UXJTYZUMZC 
- VYKPZAVNAH 

3 WZLVABWOBI 
- XAWBCXPCJ 
- YB R XGDYQPK 
-Z GOYDBZRBL 

4 ADPZEFASFM 
4 BEQAFGBTGH 

2 CFRCGHCUHO 

3 DGSCHIDVIP 
flffiEBHB WJfr- 
FIUEJKFXKR 

r_ T T?WT P VTfi 

uv VTIuaTXeD 



- YBBCXIBMBg - 

- ZJKHfJBMFH - 

-a k -q &zktoqp - 

2 BLPAALUPHJ 
GMQBBMVQIK 

4 DNRCCRWRJL 
- EO S BBOXSKM 

5 FPTEEPYTLN 
- GQUFFQZUMO 

4 HRVGGRAVMP 
4 ISWHHSBWOQ 
- JTXIITCXPR 
- KUYJJUDY Q S 
- LVZKKVEZ RT- 

3 MWALLWFASU 
- KXBMMXGBW 

3 OYCNNYHCUW 

nrmArtff TTVtrv 
iuUwijli/T A 

- QAEPPAJEWY 

-RB F 3 Q B KFX& 

4 SCGRRCLGYA 
3 TOHSSDMHZB 
8 UEITTENIAC 

- VFJUUFOJHD 

-W GKWGPKCE 

-j fflmWHQiiDF 



Figure 14. 



Note that in this example the correct generatrix in each alphabet is the one 
with the highest score. 6 This weighting system, crude as it may appear, 
suffices in cases where the generatrices contain at least 8-10 letters. 

When the number of letters per generatrix is small, there exist more re- 
fined statistical methods for the selection of the correct generatrices, 
these methods will be treated in par. 34 in the next chapter. 



0 

Theoretically the generatrix with the greatest value will be the correct generatrix In actual 
practice of course the generatrix with the greatest value may not be the correct one but the correct 
one will certainly be among the three or four generatrices or so with the largest values In any case 
the test of correctness is whether when juxtaposed, a set of two or three generatrices selected will 
yield 'good digraphs or trigraphs l e high-frequency digraphs or trigraphs such as occur m normal 
plain text 
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h. It has been seen how the key word may be discovered in this type 
of cryptogram. Usually the key is made up of those letters in the suc- 
cessive alphabets whose equivalents are but other conventions are of 
course possible. Sometimes a key number is used, such as 8 -4-7 -1-2, which 
means merely that Ap is represented by the eighth letter from A (in the 
normal alphabet) in the first cipher alphabet, by the fourth letter from 
A in the second cipher alphabet, and so on, as in the classic Gronsfeld 
cipher. However, the method of solution as illustrated above, being inde- 
pendent of the nature of the key, iB the same as before. 

22. Solution by the "probable -word method." — a. The common use of 
plaintext words as key words in cryptograms such as the foregoing makes 
possible a method of solution that is simple and can be used where the 
more detailed method of analysis using frequency distributions or by com- 
pleting the plain -component sequence iB of no avail. In the case of a 
very short message which may show no recurrences and give no indications 
as to the number of alphabets Involved, this modified method will be 
found most useful. 

b. Briefly, the method consists in assuming the presence of a prob- 
able word in the message, and referring to the alphabets to find the key 
letters applicable when this hypothetical word is assumed to be present 
in various positions in the cipher text. If the assumed word happens to 
be correct, and is placed in the correct position in the message, the key 
letters produced by referring to the alphabets will yield the key word. In 
the following example it 1 b assumed that reversed standard alphabets are 
known to be used by the enemy. 



Message 

PGSGG DNRUH VMBGR YOUUC WMSGL VTQDO 

c. Extraneous circumstances lead to the assumption of the presence of 
the word REGIMENT. One may assume that this word begins the message. Using 
sliding normal components, one reversed, the other direct, the key letters 
are ascertained by noting what the successive equivalents of Ap are. Thus : 

Cipher: PGSGGDHB 

Plain text: REGIMENT 
"Key" GKYOSHAK 

The key does not spell any intelligible word. One therefore shifts the as- 
sumed word one letter forward and another trial is made. 

Cipher: GSGGDNRU 

Plain text: REGIMENT 
"Key" XWMOPREN 

This also yields no intelligible key word. One continues to shift the 
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assumed word forward one space at a time until the following point is 
reached: 



Cipher: UHVMBGRY 

Plain text: REGIMENT 

"Key" LLBUNKER 

The key now becomes evident. It is a cyclic permutation of BUNKER HILL . 

It should be clear that since the key word or key phrase repeats Itself 
during the encipherment of such a message , the plaintext word upon whose 
assumed presence in the message this test is being based may begin to be 
enciphered at any point in the key, and continue over into the next repeti- 
tion of the key if the probable word is longer than the key. When this is 
the case it is merely necessary to shift the latter part of the sequence 
of key letters to the first part, as in the case noted: LLBUNKER is per- 
muted cyclically into BUNKER. .LL, and thus BUNKER BUI.. 

d. The examples in subpar. c, above, merely illustrate the theory 
of "placing" a probable word and recovering the key word. In actual 
practice, the application of the probable -word method proceeds along slightly 
different lines of a short-cut manner, as will be described below, using the 
same message and probable word as stated in the preceding subparagraph. 

(1) The cipher text is written in a horizontal line on cross-section 
paper, and the first five letters or so of the probable word are written 
columnarwise to the left of the cipher text and one space below it. As- 
suming first that direct standard alphabets have been used, the successive 
letters of the cipher are deciphered as Rp, writing the respective key 
letters (as derived under Ap or the assumed index letter) on the first line 
just below the cipher text; this assumes that Rp exists at one of the N-6 
possible positions (for the word REGIMENT). Then the presence of the letter 
Ep is assumed in the text (beginning with the second letter of the message), 
and the successive key letters from these decipherments are Inscribed in 
the second line for N-7 positions. On the third line the process is re- 
peated, assuming that Gp is present in N-6 possible positions beginning 
with the third letter of the cryptogram, writing the respective decipher- 
ments under each ©c . 

(2) N ow if the trlgraph REGp exists in the message, then the juxta- 
position of REGp at its correct location in the cipher text will yield on 
a diagonal a plaintext trigraph which is a part of the repeating key, if 
the key is a plaintext word or phrase . So by examining the possible plain- 
text trigraphs and extending them to 1, 2, 3; or more places if necessary, 
all but one will be eliminated by inconsistencies (i.e., implausible plain- 
text polygraphs), as only one polygraph will keep on yielding valid plain 
text. If the first trials with direct standard alphabets are not successful, 
then reversed standard alphabets are tried. It is important to keep in mind 
that plaintext trigraphs a re n ot necessarily only those which are contained 
within words; observe the LLB trigraph in Fig. 15 b, below, which occurs 
between words at a cyclical repetition of the key”phrase BUNKER HILL. 
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(3) In the following three figures, Fig. 15a is the attempted 
solution under the premise that the alphabets employed are direct stand- 
ard, Fig. 15b is the successful trial with reversed standard alphabets, 7 
and Fig. 15c~is the complete decipherment of the message after the key 
word has been recovered. 



PGSGGDNRUHVMBGRYOUUCWMSGLVTQDO 
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e. Another method for testing cribs vhere the components are known 
is illustrated in Fig. 16, below. This method involves the completion 
of all the generatrices from the cipher text, and searching for the key 




Figure 16. 



by means of a stencil pre -cut to the probable word being tested. 

(l) In this example, using the same message and crib as in the pre- 
ceding subparagraph, the top row of the diagram is the cipher message, the 
identical row just beneath the cipher consists of the key letters (on the 
hypothesis of reversed standard alphabets) if the ciphertext letters rep- 
resent encipherments of Ap, the next row (QHTHH. . . ) consists of the key 
letters if the ciphertext letters represent encipherments of Bp; and so 
forth. A stencil or mask is made on cross-section paper of the same size 
cells as the cross-section paper used to complete the generatrices, with 
appropriate cells cut out in successive columns to represent the letters 
of the crib (lining for this purpose the reference alphabet to the left of 
the diagram). This stencil can now be slid along the horizontal axis 
through successive positions of the diagram, when the correct placement 
of the crib is reached, the letters of the key (in this case, LLBUNKER) 
will manifest themselves in the apertures. 
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(2) If ve are to test the crib on the basis of direct standard al- 
phabets (instead of reversed standard as above), the completion diagram of 
Fig. 16 may still be used, the only change necessary is that the plaintext 
reference alphabet at the left must be changed to the AZYXW. . . CDB sequence, 
to reflect the difference in deriving the key letters in the diagram. 

(3) This particular method is very valuable if there are many cribs 
to be tested, this method also has related applications in other fields of 
cryptanalysis . 

f . Two further important ramifications of the probable -word method 
should be pointed out at this time; these apply to cases wherein the 
probable word or crib is considerably shorter than the repeating key, and 
to cases where the repeating key is composed of a sequence of random let- 
ters. 



(l) Suppose that in the previous example we were testing the crib 

YOURp; at the 5th position of the cipher text we would have recovered the 
key fragment ERHI^ which appears likely as a part of a key word in English. 
We would then take this key fragment and slide it along all the remaining 
positions of the cipher text, at position 15 we would obtain the fragment 
NTTOp as p ossible plain text, and at position 25 we would obtain the frag- 
ment TWOSp. Factoring the intervals between the fragments which yielded 
plain text, we would conclude that the period of the message is 10. The 
NTTOp s equence might be preceded by an Ep, whi ch migh t be expanded into 
MEHT TOp, whi ch would yield the fragments (MD?)VEYOURp at position 3 and 
(FI?)VETWOSp at position 23. ThiB procedure would be continued until the 
message is completely solved. 

(2) In the foregoing case, ERfU^ was recognized as a possible key 
fragment because it looked like a plausible sequence of a plaintext key 
word. If the key had not been a plaintext word, but instea d had been, let 
us say, the arbitrary letters CBNOMRGOWB, then the fragment MRGOk of this 
seque nce would not have been recognized as part of the key when the crib 
YOURp was tried at the 5th position. The procedure followed in cases where 
the key is composed of random letters Is to assume the crib at position 1, 
derive the "key", and slide this "key" along the rest of the message to see 
whether possible plain text results, then the crib is tried at positions 2, 
3, 4... in turn, until its placement at the correct position yields deci- 
pherments in other parts of the message which are recognized as valid plain 
text. This technique, although laborious when done by hand, is the basis 
for solution when analytical machine methods are employed. 

£. It has been seen In the probable -word method described in this 
paragraph that the length of the key is of no particular interest or 
consequence in the steps taken in effecting the solution. The determina- 
tion of the length and elements of the key come after the solution rather 
than before it. In the case illustrated the length of the period is seen 
to be ten, corresponding to the length of the key (BUNKER HILL). 
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h. The foregoing method is one of the other methods of determining 
the length of the key (besides factoring), referred to in subpar. 15c. 

As vill be shown subsequently, the method can also be used as a last resort 
when known mixed alphabets are employed. This method of solution by search- 
ing for a word is contingent upon the following circumstances: 

(1) That the word whose presence is assumed actually occurs in the 
message, is properly spelled, and correctly enciphered. 

(2) That the sliding components (or equivalent cipher disks or 
squares) employed in the search for the assumed word are actually the ones 
vhich were employed in the encipherment, or are such as to give identical 
results as the ones which were actually used. 

(3) That the pair of enciphering equations used in the test is actu- 
ally the pair which was employed in the encipherment; or if a cipher square 
is used in the test, the method of finding equivalents gives results that 
correspond with those actually obtained in the encipherment. 

i. . The foregoing appears to be quite an array of contingencies and 
the student may think that on this account the method will often fall. But 
examining these contingencies one by one, it will be seen that successful 
application of the method may not be at all rare — after the solution of 
some messages has disclosed what sort of paraphernalia and methods of 
employing them are favored by the enemy. From the foregoing remark it 

is to be Inferred that the probable-word method has its greatest usefulness 
not in an initial solution of a system, but only after successful study of 
enemy communications by more difficult processes of analysis has told its 
story to the alert cryptanalyst. Although it is commonly attributed to 
Bazerles, the French cryptanalyst of 1900, the probable-word method is 
very old in cryptanalysis and goes back several centuries. Its usefulness 
work may best be Indicated by quoting from a competent obser- 

There is another [method) which is to this first method what the geometric method is to analysis in 
certain sciences and according to the whims of individ als certain cryptanalysts prefer one to the other 
Certain others, incapable of getting the answer with one of the methods in the solution of a difficult problem 
conquer it by means of the other with a disconcerting masterly stroke This other method is that of the 
probable word We ma> have more or less definite opinions concerning the subject of the cryptogram We 
may know something about its date and the correspondents, who mav have been indiscreet in the subject 
they have treated On this basis the hypothes 1 s is made that a certain word probablv appears in the text 

In certain classes of documents, military or diplomatic telegrams, banking and mining affairs, etc 
it is not impossible to make very important assumptions about the presence of certain words in the text 
After a cryptanalyst has worked for a long time with the writings of certain correspondents he gets used to 
their expressions He gets a whole load of words to try out, then the changes of key and sometimes of sys- 
tem no longer throw into his way the difficulties of an absolutely new studv which might require the 
analytical method ' 
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Givierge M , Cours de Cryptographs Pans 1925, p 30 
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To which I am prompted to add the amusing definition of cryptanalysis 
attributed to a British wag: "All cryptanalysis is divided into two 

parts: trance -titution and supposition." 

23. The Porta system. -- a. The solution of the Porta system, de- 
scribed in subpar. lib, may properly be treated at this point along with 
repeating -key systems"with standard alphabets, since the enciphering 
matrix is a known matrix with normal components. The Porta matrix illus- 
trated in Fig. 5 may be visualized as follows: 



Flam text 



* S,T 




BCD 
OPQ 
P Q R 
Q B S 
R S T 
S T U 
T U V 
U V W 
V W X 

w x y 
x y z 
y z h 
z n 0 

NOP 



E F G 
R S T 
S T U 
T U V 
U V W 

V W X 
W X Y 
X Y Z 

Y Z N 
Z N 0 
NOP 
OPQ 
P Q R 
Q R S 



H I J 
U V w 

V W X 
W X Y 
X Y Z 

Y Z N 
Z N 0 
NOP 
OPQ 
P Q R 
Q R S 
R S T 
S T U 
T U V 



KLM 
X Y Z| 

Y Z N 
Z N 0 
NOP 
OPQ 
P Q R 
Q R S 
R S T 
S T U 
T U V 
U V W 

V W X 
W X Y 



N 0 P Q 
A B C D 
M A B C 
L M A B 
KLMA 
J K L M 
I J K L 
H I J K 
G H I J 
FGEI 
E F G H 
D E F G 
C D E F 
B C D E 



R S T 
E F G 
D E F 
CDS 
BCD 
ABC 
M A B 
L M A 
KLM 
J K L 
I J K 
H I J 
G H I 
FGH 



U V w 
H I J 
G H I 
FGH 
E F G 
D E F 
C D E 
BCD 
ABC 
M A B 
L M A 
KLM 
J K L 
I J K 



X Y Z 
KLM 
J K L 
I J K 
H I J 
G H I 
FGH 
E F G 
D E F 
C D E 
BCD 
ABC 
M A B 
L M A 




b. If the message in par. 20 were enciphered by means of the Porta 
table7 the key word still being WHITE, the distributions for the five 
alphabets would appear as follows: 



- *«- jfc-*E _ ■ - - - 

1. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



asp _ S is - a 3 - a a * _ a* 

2. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



^ “ 









3. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



- _ Si a a 58 a - pi a a a _ -5Sa aS 

4. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



*aaa E B = _ ffe _ g j£ — B * _ 

5. ABCDEFGHIJKLMNOPQRSTUVWXYZ 
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Nov if a vertical dividing line is drawn between the M and the N of the 
distributions, each half of the distribution may be used to fit half of 
the normal frequency distribution (following the Porta rule of encipher- 
ment, i.e., each half of t he alphabe t going to the opposite half) . Thus 
in Alphabet 1 the sequence CDEFGHU c may easily be ident ified as NOPQRSTOpj 
this would fix the key letters as WX, and therefore the A. ..Mp sequence 
should begin at Y c . This latter fit may not b e id eal, but it is neverthe- 
les s pl a usibl e. In Alp habets 2, 3> and 5 the RSTp sequence may be spotted 
at BCD c , ABC c , and CDE c , respectively, whereas in Alphabet 4 the trial of 
Ep as N c gives a reasonably good matching of that half of the distribution. 
These assumptions in the first halves of the distributions will of course 
determine the placements of the letters in the second halves, since, for 
example in Alphabet 4, if N c ■ Ep, then Ec ■ Npj therefore the original 
assumptions for the first halves will be confirmed or rejected by the 
goodness of fit of the distributions for the second halves. The keys for 
these five alphabets are derived as (W,X), (G,H), (l,j), (S,T). and 
(E,F ) ; from these letters, the repeating key WHITE is obvious. 

c_. In completing the plain -component sequence in the case of Porta 
encipherment, the cipher letters of each alphabet are first converted to 
their /Porta/ plain -component equivalents, and then the plain -component 
sequence is canqileted from these letters, with a minor modification. This 
modification consists in completing the converted cipher letters A-M in 
a downward direction, while the letters N-Z are completed in the opposite 
(i.e. , upward) direction. As an example of this process, let us assume 
that the message in subpar. 20h has been enciphered by five alphabets in 
the Porta system, the first forty letters of this encipherment are: 

PKTFF CDVIT OBVZX CVREE GIVJE TPRKT 

OQCFL PBVPX ... 

The conversion process and plain-component completion of the first three 
alphabets are shown in the diagram below (employing the procedure of 
generatrix elimination and weighting as described in subpars. 21f and g) : 



9 

In some cases the lower half of the Porta alphabets shifts to the right instead of to the left as in the 
normal form, this possibility mi st be taken into account in die recovery of the key word 
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PCOCGTOP 
1CPBPTGBC 
3DOCOSHCD 
6EKDNRIDE 
F-- Z - E - a Q J B F - 
OGTFYPKFG 
-8XGX0LG H 
3IWHWNMHI 
-J YIVZAIJ 
- K - G - J U Y B J K 
- iiTKTXCKL 
2MSLSWDLM 
5ARMRVEMA 
- BQAQUFAB 



KDBVIPQB 
-X- ft 01 V 0 D 0 
3WPMJUDEN 

-V - 0 a K T B F z 
2 UNYLSFGY 
- f H M R C HX 
3 SYWAQHIW 
-R- X - V - B - P I J V 
UOOJKO 
3 PVTDHKLT 
30 USEZLMS 
5 HTRFYMAR 
-a-S $ G X A B Q 
1 YRPHWBCP 



TVYRVRCV 
6GIIEISPI 
- H - J - J- F - J -- F 
■ XXKGXG B- K- 
JLL H L g g L - 
2KMMIMIYM 
t A - A J A - J X - A - 
MBBKBKWB - 
1ACCLCLVC 
OBDDMDMUD 
7CEEAEATE 
ODFFBFBSF 
2EGGCGCRG 
OFHHDHDQH 



The generatrices with the highest scores are the correct ones. 

d. Just as the Vlgenere table (consisting of direct standard al- 
phabets) has its complementary table of reversed standard alphabets, a 
variant of the Porta table might be constructed wherein the lower halves 
of the sequences run in the opposite direction to the upper half, as is 
illustrated below: 




In this case, the method of fitting the distributions to the normal and 
the method of completing the plain-component sequence must of course be 
modified to take care of the new situation. Other variations of the 
Porta idea are possible; these will be treated in subsequent chapters. 



e. In applying the probable -word method in Porta, the cryptographic 
peculiarities of the system greatly facilitate the testing and placing of 
cribs. As an illustration, let us suppose we have at hand the 40 -let ter 
fragment in subpar. 23c (the period being unknown), and let us place under 
each cipher letter a notation of its class (using "1" to designate a cipher 
letter from the Group A-M in the normal sequence and ”2" to designate a 
letter from the group H-Z). The cipher text and notations will look as 
follows: 

PKTFF CDVIT OBVZX CVREE GIVJE TPRKT 

21211 11212 21222 12211 11211 22212 



0 Q C F L 
2 2 111 
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P B V P X 
2 12 2 2 
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Let us suppose that the probable word is INFAHTOY, the letters of this 
word have the class notation of 12112222, but in encipherment the classes 
would be reversed, viz., 21221111. We now look for the pattern 212 21111 
in the cipher text, and we find it beginning at the 15th position. The 
derived key/E W G I S E W G\can easily be recognized as a cyclical repe- 
V F X H J T F X S J 
tition of the key word WHITE. 

24. The Gronsfeld system. Ohe Gronsfeld system mentioned earlier is 
identical with a Vigeriere system with direct standard alphabets (where only 
the first 10 alphabets are used) , except that a numerical key is involved, 
the digits of the key indicating how much displacement the plaintext letters 
should have along the normal sequence; thus only the first ten rows of the 
Vigenere table are used. The Gronsfeld system is solved just like any 
Vigenere system, except (when the system is known to be a Gronsfeld) for 
a minor modification in the use of the probable -word method. The severe 
limitation of the cipher equivalents possible for a given plaintext letter 
greatly r estri cts the placement of trial cribs. For example, in trying 
the crib YOURp in a message, the diagram below (analogous to Fig. 15a) 




shows the keys resulting from the only possible Gronsfeld decipherments of 
Yp in the first row beneath the cipher; the row Just beneath that gives the 
keys for Op ( where Y p has been a possibility for the preceding cipher letter) ; 
etc. In the example, there are only two places where YOURp is a possibility: 
at the 5th and l4th positions, with the corresponding keys oeing 0274 and 
6639 , respectively. If 0274 is slid through the remainder of the cipher 
text, the appearance of the plaintext fragments MENT (at position 13) and 
FIVE (at position 21) shows that this key fragment is correct, and that the 
period is 6. If the solution proved difficult, the plain -component sequences 
could be completed for the remaining cipher text as shown below, as an aid in 

0274 0274 0274 02 

TSVHYQBVYIGLMOUXASRMFKCIAAOVIE 



SRUGYOURXHFKMEHTZRQLFI 


fEZZNUIX 


R Q T F 


W G E J 


YQPK 


Y Y M T 


Q P S E 


V F D I 


X P 0 J 


X X L S 


P 0 R D 


U E C H 


W 0 H I 


W W K R 


ONQC 


T D B G 


V H M H 


V V J Q 


SHPB 


S C A F 


U M L G 


U U I P 


M L 0 A 


R B Z E 


TLKF 


T T H 0 


LKRZ 


Q A Y D 


S K J E 


SSGH 


K J M Y 


P Z X C 


R J I D 


R R F M 
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recovering the rest of the text. It must be pointed out that, although 
reading a Gronsfeld cipher of a lengthy period on ten generatrices alone 
is quite possible, it may be rather difficult to do so in actual practice 
unless something concerning the contents or nature of the message plain 
text is known. 

25. Polyalphabetic numerical systems. — a. Periodic number ciphers 
may be encountered in which the plain component is the normal sequence ^ 
and the cipher component is what may be regarded as a standard /numerical^ 
sequence. For instance, if the cipher component consisted of the dinomes 
01-26 in normal order, this component is in effect an A-Z sequence and 
analysis would proceed along the lines of any direct standard alphabet 
cipher. In Fig. 6 we have a numerical Vigenere square consisting of a 
36-element "normal" plain component and a cipher component consisting of 
the dinomes 10-45 in ascending order; this system involves notning new in 
techniques of solution, except that in fitting the cipher distributions to 
the normal (after factoring), allowance has to be made for the beginning 
and ending points of the A-Z sequence in the 36 elements of the cipher 
distributions . 



b. If periodic numerical ciphers are encountered in which the cipher 
conqjonents are slides of the 00,01. . .98,99 sequence in normal order, the 
occurrence in certain alphabets of dinomes within a comparatively narrow 
range will be an aid to factoring. For example , if the matrix in the 
illustration below were used for encipherment, the occurrence of the "low 

ABCDEFGH VWXYZ 




A 


B 


c 


D 


E 


F 


G 


H 


03 


oF 


05 


06 


07 


08 


09 


10 


4l 


42 


43 


44 


45 


46 


47 


48 


28 


29 


30 


31 


32 


33 


34 


35 


70 


71 


72 


73 


74 


75 


76 


77 


32 


33 


34 


35 


36 


37 


38 


39 




dinomes" (resulting from encipherments by Alphabet l) spaced along the 
cipher text at an interval of 5, and the "high dinomes” (resulting from 
encipherments by Alphabet 4) likewise spaced along the cipher text at that 
same Interval, would quickly identify the length of the period. 
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CHAPTER V 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, Ij 
DIRECT SYMMETRY OF POSITION 
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26. Reason for the use of nixed alphabets. — a. It has been seen in 
the examples considered thus far that the use of several alphabets in the 
sane message does not greatly complicate the analysis of such a cryptogram. 
There are three reasons vhy this is so. Firstly, only relatively fev al- 
phabets were employed; secondly, these alphabets were employed in a per- 
iodic or repeating manner, giving rise to cyclic phenomena in the crypto- 
gram by means of vhlch the number of alphabets could be determined; and, 
thirdly, the cipher alphabets vere known alphabets, by which is meant merely 
that the sequences of letters in both components of the cipher alphabets 
vere known sequences. 

b. In the case of monoalphabetic ciphers it was found that the use of 
a mixed alphabet delayed the solution to a considerable degree, and it will 
now be seen that the use of mixed alphabets in polyalphabetic ciphers 
renders the analysis much more difficult than the use of standard alphabets, 
but the solution is still fairly easy to achieve. 

27. Interrelated mixed alphabets. -- a. It was stated in par. 7 that 
the method of producing the mixed alphabets in a polyalphabetic cipher often 
affords dues vhlch are of great assistance in the analysis of the cipher 
alphabets. This is so, of course, only when the cipher alphabets are inter- 
related secondary alphabets produced by sliding components or their equiv- 
alents. Reference is now made to the classification set forth in par. 8, 

in connection with the types of alphabets vhlch may be employed in poly- 
alphabetic substitution. It will be seen that thus far only Cases la and b 
have been treated. Case Ila will now be discussed. ” 
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b. Here one of the components , the plain component , is the normal 
sequence, while the cipher component is a mixed sequence, the various 
Juxtapositions of the two components yielding mixed alphabets. The mixed 
component may be a systematically •mixed or a random-mixed sequence. If 
the 25 successive displacements of the mixed component are recorded in 
separate lines, a symmetrical cipher square such as that shown in Fig. 17 
results therefrom. It is identical in form with the square table shown 
in Fig. 9 . 



Plain 



Cipher 



ABCDEFGHIJKLMHOPQBSTUVWXYZ 
LEAVHWOR 1EBCSFGI JKMPQSUXYZ 
EAVNWORTHBCDFGIJKMPQSUXYZL 
AVNWORTHBCDFGIJKMPQSUXYZLE 
VHWORTHBCDFGIJKMPQSUXYZLEA 
NWORTHBCDFGIJKMPQSUXYZLEAV 
WORTHBCDFGIJKMPQSUXYZLEAVN 
ORTHBCDFGIJKMPQSUXYZLEAVHW 
RTHBCDFGIJKMPQSUXYZLEAVHWO 
THBCDFGIJKMPQSUXYZLEAVNWOR 
HBCDFGIJKMPQSUXYZLEAVNWORT 
BCDFGIJKMPQSUXYZLEAVHWORTH 
CDFGIJKMPQSUXYZLEAVNWORTHB 
DFGIJKMPQSUXYZLEAVHWORTHBC 
FGIJKMPQSUXYZLEAVNWORTHBCD 
GIJKMPQSUXYZLEAVHWORTHBCDF 
IJKMPQSUXYZLEAVNWORTHBCDFG 
JKMPQSUXYZLEAVHWORTHBCDFG I 
KMPQSUXYZLEAVNWORTHBCDFGIJ 
MPQSUXYZLEAVHW ORTHBCDFGIJK 
PQSUXYZLEAVNWORTHBCDFGIJKM 
QSUXYZLEAVNWORTHBCDFGIJKMP 
SUXYZLEAVNWORTHBCDFGIJKMPQ 
UXYZLEAVNtf ORTHBCDFGI JKHPQS 
XYZLEAVNWORTHBCDFGIJKMPQSU 
YZLEAVHWORTHBCDFGIJKMPQSUX 
ZLEAVHWOBTHBCDFGIJKMPQSUXY 

Figure 17. 



£. Such a cipher square may be used in exactly the same manner as the 
Vlgen&re square. With the key word BLUE and conforming to the normal en- 
ciphering equations (©*/2 ■ ®i/lJ ®p/l ■ ® c /2^ > the following lines of the 
square would be used: 



ABCDEFGHIJKLMHOPQBSTUVWXYZ 
BCDFG IJKMPQSUXY ZLEAVNW ORTH 
LEAVHWORTHBCDFGI JKMPQSUXYZ 
UXYZLEAVNWORTHBCDFGIJKMPQS 
EAVNWORTHBCDFGIJKMPQSUXYZL 



Figure 18a. 
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These lines would, 


of course, yield the following cipher 


alphabets : 


(1) 


Plain.... A 


B 


C 


D 


E 


F 


G H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


W 


X 


Y 


Z 


Cipher... B 


C 


D 


F 


G 


I 


J K 


M 


P 


Q 


S 


U 


X 


Y 


Z 


L 


E 


A 


V 


N 


W 


0 


R 


T 


H 


(2) 


Plain.... A 


B 


C 


D 


E 


F 


G H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


Cipher . . . L 


E 


A 


V 


N 


W 


0 R 


T 


H 


B 


C 


D 


F 


G 


I 


J 


K 


M 


P 


Q 


S 


u 


X 


Y 


Z 


(3) 


Pl&iu* • • • A 


B 


C 


D 


E 


F 


G H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


w 


X 


Y 


z 


Cipher... U 


X 


Y 


Z 


L 


E 


A V 


N 


W 


0 


R 


T 


H 


B 


c 


D 


F 


G 


I 


J 


K 


M 


P 


Q 


s 


W 


PI&Iq* • • • A 


B 


C 


D 


E 


F 


G H 


I 


J 


K 


L 


M 


0 


0 


p 


Q 


R 


S 


T 


u 


V 


w 


X 


Y 


z 


Cipher... E 


A 


V 


N 


W 


0 


R T 


H 


B 


C 


D 


F 


G 


I 


J 


K 


M 


P 


Q 


s 


U 


X 


Y 


Z 


L 


















Figure 18b. 




























28. Principles 


of direct 


symmetry of 


position. ■ 


—a. 


It 


was 


stated 



directly above that Fig. 17 is a symmetrical cipher square , by vhich is 



meant that the letters in its successive horizontal lines show a symmetry 
of position with respect to one another. They constitute, in reality, one 
and only one sequence or series of letters, the sequences being merely 
displaced successively 1, 2, 3, ... 25 intervals. The symmetry exhibited 
is obvious and is said to be visible, or direct . This fact can be used to 
good advantage, as will presently be demonstrated. 



b. Consider, for example, the pair of letters G c and V c in cipher 
alphabet (l) of Fig. l8b. The letter V c is the 15th letter to the right of 
G c . In cipher alphabet~(2) , V c is also the 15th letter to the right of 
G c , as is the case in each of the four cipher alphabets in Fig. 18b, since 
the relative positions they occupy are the same in each horizontal line in 
Fig. l8a, that is, in each of the successive recordings of the cipher com- 
ponent as the latter is slid to the right against the plain or normal com- 
ponent. If, therefore, the relative positions occupied by two letters, 

01 and 62, in such a cipher alphabet, Ci, are known, and if the position 
of 0i in another cipher alphabet , C 2 , belonging to the same series is known 
then 0 2 may at once be placed into its correct position in C2. Suppose, 
for example, that as the result of an analysis based upon considerations 
of frequency, the following values in four cipher alphabets have been tenta 
tlvely determined: 



( 1 ) 



P l ai n. . . . 
Cipher... 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 
G Y V 



( 2 ) 



Plain. . . . 
Cipher... 



ABCDSFGEI JKLM 
N 



OPQRSTUVWXYZ 
G P 



( 3 ) 



Plain .... 
Cipher... 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 
L B I 



w 



Plain. . . . 
Cipher . . . 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 
W IQ 
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£. The cipher components of these four secondary alphabets may, for 
convenience , be assembled into a cellular structure, hereinafter called a 
sequence reconstruction matrix , as shewn in Fig. 19b. Regarding the top 
line of the reconstruction matrix in Fig. 19b as being common to all four 
secondary cipher alphabets listed in Fig. 19a, the successive lines of the 
reconstruction matrix may now be termed cipher alphabets, and may be re- 
ferred to by the numbers at the left. 



Plain 


ABCDEF 6 HI JKLMNOPQRS 


T U V W X Y Z 


1 


G 


Y 


V 


2 


N 


G 


P 


Cipher ^ 


L 


B 


I 


k 


W 


I 


A 



Figure 19b. 



d. The letter G is common to Alphabets 1 and 2. In Alphabet 2 it is 
noted~that N occupies the 10th position to the left of G, and the letter P 
occupies the 9th position to the right of G. One may therefore place these 
letters, N and P, in their proper positions in Alphabet 1, the letter N 
being placed 10 letters before G, and the letter P, 9 letters after G. Thus: 

Plain 
1 

Thus, the values of two new letters in Alphabet 1, viz . , Pc * Jp, and 
H c e Up have been automatically determined; these values were obtained 
without any analysis based upon the frequency of Pc and N c . Likewise, in 
Alphabet 2, the letters Y and V may be inserted in these positions: 

Plain 
2 



ABCDBFGHIJKLMNOPQRSTUVWXYZ 
V H G P Y 



ABCDEFGHIJKLMKOPQRSTUVWXYZ 
G P Y VN 



This gives the new values V c » Dp and Y c ■ Yp in Alphabet 2. Alphabets 3 
and h have a common letter I, which permits of the placement of Q and W in 
Alphabet 3, and of B and L in Alphabet 4. 



e. The new values thus found are of course immediately inserted 
throughout the cryptogram, thus leading to the assumption of further values 
in the cipher text. This process, viz . , the reconstruction of the primary 
components , by the application of the principles of direct symmetry of 
position to the cells of the reconstruction matrix, thus facilitates and 
hastens solution. 

f . It must be clearly understood that before the principles of direct 
symmetry of position can be applied in cases such as the foregoing, it is 
necessary that the plain component be a known sequence . Whether it is the 
normal sequence or not is immaterial, so long as the sequence is known. 
Obviously, if the sequence is unknown, symmetry, even if present, cannot be 
detected by the cryptanalyst because he has no base upon which to try out 
his assumptions for symmetry. In other words, direct symmetry of position 
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Is manifested in the illustrated example because the plain component is a 
known sequence , and not because it is the normal alphabet. The significance 
of this point will become apparent later on in connection with the problem 
discussed in par. 36 b. 



29. Initial steps in the solution of a typical example.- - a. In the 
light of the foregoing principles let a typical message nov be studied. 









5 






10 


15 








20 








25 










30 


A. 


Q W B 


R_ 


I 


V W 


Jf 


C 


A 


I S P J L 


R 


B 


Z 


E Y 


Q W 


Y 


E U 


L 


W 


M 


G W 


B ‘- 


| I C J 


C 


I 


M T 


Z 


E 


I 


HIBKN 


Q H 


B 


R 


I 


V 


W_ 


_Y 


I 


G 


B 


W 


N 


B 


Q 


C. 


QCG 


Q 


H 


I W 


J 


K 


A 


GEGXH 


I 


D 


MRU 


V 


E 


Z 


Y 


G 


Q I 


G 


V 


N 


D. 


C T G 


Y 


0 


B P 


D 


B 


L 


V C G X G 


B 


K 


Z_ 


Z_ 


G 


I 


V 


X 


C 


U 


N 


T 


Z 


A 


0 


E. 


B W F 


E 


Q 


Q L 


F 


C 


0 


M T Y Z T 


C 


C 


B 


Y 


Q 


0 


P 


D 


K 


A 


G 


D 


G 


I 


G 


F. 


V P W 


H R 


Q I 


I 


E 


W 


I C G X G 


B 


L 


G 


Q Q 


V 


B 


G 


R 


S 


M Y 


J 


J 


Y 


G. 


Q V F W 


Y 


R W 


N 


F 


L 


G X H F W 


M 


C 


J 


K 


X 


I 


D 


D 


R 


U 


0 


P 


J 


Q Q 


H. 


ZRHC 


N 


V W 


D 


Y 


Q_ 


R D G D G 


B 


X 


D 


B 


N 


P 


X 


F 


P U 


Y 


X 


JL 


F 


G 


J. 


M P J 


JL 


_L 


SAN 


C 


D 


S E Z Z G 


I 


B 


E 


Y 


U 


K 


D 


H 


C 


A 


M 


B 


j 


J 


F 


K. 


K I L 


c 


J 


M F 


D 


Z 


T 


C T J R D 


M 


I 


Y 


Z 


Q 


A 


C 


J 


R 


R 


S 


B 


G 


Z 


N 


L. 


Q Y A 


H 


Q 


V E 


D 


c 


Q 


LXHCL 


L 


V 


V 


C 


S 




I 


I 


I 


V 


J 


R 


N 


M. 


W N B 


R 


I 


V P 


_J 


E 


L 


T A G D N 


I 


R 


G 


Q 


P 


A 


T 


Y 


E 


W 


C 


B 


Y 


Z_ 


_T 


H. 


E V G 


Q U 


V P 


Y 


H L 


L R Z N Q 


X 


I 


R 


B 


A 


I 


K W 


J 


Q_ 


R 


_D 


Z 


Y 


F 


P. 


K W F 


Z 


L 


G V 


F 


J 


Q 


Q W J Y Q 


I 


B 


W 


R 


X 
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b. The principal repetitions of three or more letters have been 
underlined in the message and the factors (up to 2 6 only) of the intervals 
between them are as follows: 



CJfBRIVWY 


45 


3, 5, 9, 15 


CGXGB 


60 


2 , 3, 4, 5 , 6, 10 , 12 , 15 , 20 


PJEL 


95 


5, 19 


ZZGI 


145 


5 


BRIV 


330 


2, 3 , 5, 6, 10, U, 13 , 22 


BRIV 


285 


3, 5, 15, 19 


KAG 


75 


3, 5, 15, 25 


QRD 


165 


3, 5, 15 


CJfB 


45 


3, 5, 9, 15 


QiJB 


275 


5, 11, 25 


WIC 


130 


2 , 5 , 10 , 13, 26 


XHF 


45 


3, 5, 9, 15 


YZT 


225 


3, 5, 15, 25 


ZTC 


145 


5 



The factor 5 is common to all of these repetitions, and there seems to be 
every indication that five alphabets are involved. Since the message al- 
ready appears in groups of five letters, it is unnecessary in this case to 
rewrite it in groups corresponding to the length of the key. The uniliteral 
frequency distribution for Alphabet 1 is as follows: 



$ S $ 2 

-M - ■ P = = $- = -$ = = -. $ 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

c. Attempts to fit this distribution to the normal on the basis of a 
direct’ or reversed standard alphabet do not give positive results, and it is 
assumed that mixed alphabets are Involved. Individual triliteral frequency 
distributions are then compiled and are shown below. These tables are simi- 
lar to those made for single mixed -alphabet ciphers, and are made in the 
same way except that instead of taking the letters one after the other, the 
letters which belong to the separate alphabets now must be assembled in 
separate tables. For example, in Alphabet 1, the trlgraph QAC means that A 
occurs in Alphabet 1; Q, its prefix, occurs in Alphabet 3> and C, its suffix, 
occurs in Alphabet 2. All confusion may be avoided by placing numbers in- 
dicating the alphabets in which they belong above the letters, thus: q]^ 
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Alphabet 1 



ABODE 


F G 


H I J K L 


U N 


0 


P Q 


R S T 


U V W 


X Y Z 


QC GW NT TV 


AE 


AS UD UW 


IT UT 


QP 


NX -ff 


LB LA LA 


IN NN 


QI UX QR 


PT OP TO 


AD 


ffC FI QX 


II 


UP 


Yff 


YV DE 


Iff 




GK TT 


LX 


Hff Fff LV 


OT 




Nff 


QD RB 


UE 




Off WB 


Lff 


ND LR 


SY 




QC 


QD 


LC 




GL 




GV 


ffC 




GI 




GP 




GX 




ffC 


GP 




QL 




QB 








XD 


AB 




RI 




Nff 








GB 


JF 




YV 




QE 








IV 


DI 




NY 




IP 








NR 






Sff 




UP 








AK 






QW 












QB 















A B C D E F G 


H I J 


Alphabet 2 

K L U N O 


P Q 


R S 


T U 


V w 


X Y Z 


SN RZ IJ 111 GG UD 


MB 


Iff QF WB 


BD 


ZH IP MZ 


IX QB 


GN MJ 


TG VG QG GG VZ 


QG 


BZ BG 


OD 


IG 


CG 


QF VY 


BD QA 


IE VG ID SZ 


QI 




VW 


LZ 


NZ 


LV QY 


PF 


MJ CB RG VD 


KL 




OJ 




MY 


IJ LM 


YN 


SG IG KH 


MY 




MJ 




CJ 


EG QB 


LN 


CY MJ RZ 


XN 




VJ 




AY 


VY 




Iff AJ 






VY 






BN 
















IJ 
















BF 
















RN 
















VD 
















QB 
















KF 
















GF 
















QJ 








Alphabet 3 












A B C D E F G 


H I J 


K L M N 0 


P Q 


R S 


T U 


V ff 


X Y Z 



YH WR 


PB BY WE CQ RC 


IE CC 


IC WG WB SJ 


VC PM 


VC WC BE 


IK 


PK 


LC EX DC 


WK 


DR WF 


KJ 


WE TE 


WR 


DR 


VW IV 


YJ 


XF 


BR 


WI EY 


CY 


WY 


XP TY 


CK 


XF 




TZ KZ 


ffl 


XB 


WZ CX 


PQ 


AC 




IZ TA 


NR 


FZ 


WJ DI 


PE 


XC 




TE EZ 




EC 


CX 


BJ 


IB 




BZ RN 






LQ 


TR 






PH DY 






BR 


CR 












DD 


VR 












BZ 


PE 












AD 


WY 









RQ 

VQ 
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Alphabet 4 




A B 


C D E 


F G 


H I J 


K L 


M N 0 P Q R 


S T U V 


W X Y 


Cl 


CS 


JK IB 


QI RV CM 


JR 


KQ, YB QA BQ MQ RM ZC EL 


GI KI EQ 


KG 


RM 


YK YQ 


CM 


BV 


XI AB EQ RS CQ ZC RV 


El R- JQ 


KG 




XB 


EM 


FG 


VC CM YO 


ZE CN 


FM WR 


CM 




ZI 


RV 


ES 


CV QV 


RO 


EC 


BI 




IV 


II 


CL 


BP QZ 


PY 








XB 


RV 


ET 


ZQ YR 


YK 








DB 




HL 


RW ZA 


QV 








FM 




ZG 


DI HV 










ZI 






CL 







1- 2-3-4-5-1-2-3 

Q W B R I V W Y-2 

2- 3-4-3-1 

C G X G B-2 

2- 3 -4-5 

pjrt-2 

3 - 4-5-1 

B R I V-3 
Z Z G 1-2 



Condensed table of repetitions 

1-2-3 4-5-1 1-2 

2 Q W B-3 K A G-2 Q W 
Z T C-2 V P 



2-3-4 
X H F-2 

hhl 

Y Z T-2 



5-1-2 
Q R D-2 
W I C-2 



1-2 
Q W-5 

V P-3 

V W-3 



hi 

C G-3 
C J-3 
P J-3 
w B-3 
W F-3 
W Y-3 
X N-3 



B R-3 
G Q-4 
G X-3 
J R-3 
N F-3 

Y Z-3 

hi 

R 1-3 

Y Q-3 
Z T-3 

hk, 

G B-4 
I v-3 
Q Q-3 
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d. One now proceeds to analyze each alphabet distribution, in an 
endeavor to establish identifications of cipher equivalents. First, of 
course, attempts should be made to separate the vowels from the con- 
sonants in each alphabet, using the same test as in the case of a single 

mixed-alphabet cipher. There seems no doubt that $ c and 4; are equivalents 
of %>. In the other alphabets the equivalents of Ep are not so clear-cut, 
but for the moment, let us assume that Bp is the highest 0c in the particu- 

1 3 4 

lar alphabet, viz . , I c , G c , and C c . 

e. The letters of greatest frequency in Alphabet 1 are I, M, Q, V, 

B, G,~L, R, S, and C. I c has already tentatively been assumed to be Ep. 

2 5 

If W c and Qc * Ep, then one should be able to distinguish the vowels from 
the consonants among the letters I, M, Q, V, B, G, L, R, S, and C by exam- 

2 5 

ining the prefixes of W c , and the suffixes of Qc* The prefixes and suffixes 
of these letters, as shown by the trill teral frequency distributions, are 
these : 

Prefixes of W c («Ep) 

G K V R B I L 

g — 

1 

f. Consider now the letter Me; it does not occur either as a prefix 

2 5 

of W c , or as a suffix of Qc* Hence It is most probably a vowel, and on ac- 
count of its high frequency it may be assumed to be Op. On the other hand, 

1 2 

note that Qc occurs five times as a prefix of W c and three times a3 a suffix 

5 

of Qc* It is therefore a consonant, most probably Rp, for it would give the 

51 12 

digraph ERp(* QQc) as occurring three times and REp(» CJJ c ) as occurring five 
times. 



Suffixes of Qc (»Ep) 

_ S m at 

IQRXLVAZO 



1 2 

g. The letter V c occurs three times as a prefix of W c and twice as a 

5 

suffix of Qc. It is therefore a consonant, and on account of its frequency. 



let it be assumed to be Tp. The letter B c occurs twice as a prefix of w c 

5 

but not as a suffix of Qc. Its frequency is only medium, and it is probably 

1 2 

a consonant. In fact, the twice repeated digraph BW C Is once a part of the 

512 5 

trigraph GEW, and G c , the letter of Becond highest frequency in Alphabet 5, 
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512 

looks excellent for Tp. Might not the trigraph GBW be THEp? It will be 
veil to keep this possibility in mind. 

1 2 
h. The letter G c occurs only once as a prefix of W c and does not occur 

5 

as a suffix of Qc* It may be a vovel, but one cannot be sure. The letter 

1 2 5 

L c occurs once as a prefix of W c and once as a suffix of Qc* It may be 

1 2 

considered to be a consonant. Rc occurs once as a prefix of W c , and twice 

5 1 

as a suffix of Qc, and is certainly a consonant. Neither the letter S c nor 

1 2 5 

the letter C c occurs as a prefix of W c or as a suffix of Qc» both would seem 
to be vowels, but a study of the prefixes and suffixes of these letters lends 

l l 

more veight to the assumption that C c is a vowel than that S c is a vowel. 

5 5 5 

For all the prefixes of C, viz . , N, T, and W, are in subsequent analysis of 
Alphabet 5 classified as consonants, as are likewise its suffixes, viz . , 

5 

T, C, and B in Alphabet 2. On the other hand, only one prefix, Lc, and one 

2 1 

suffix, B c , of S c are later classified as consonants. Since vowels are 
more often associated with consonants than with other vowels, it would 

l 1 l 

seem that C c is more likely to be a vowel than S c . At any rate C c is as- 

1 

sumed to be a vovel, for the present, leaving S c unclassified. 

1. Going through the same steps with the remaining alphabets, the 
following results are obtained: 



Alphabet 


Vowels 


Consonants 


1 


I, M, C. 


Q, V, B, L, R, G? 


2 


W, P, I. 


C, Dj T. 


3 


G, Z. 


J, N, D, Y, F. 


4 


C, E?, R?, B?. 


Y, Z, J, Q. 


5 


Q, U. 


G, N, A, I, W, L, T. 



30. Application of principles of direct symmetry of position. -- a. The 
next step is to try to determine a few values in each alphabet. In ATphabet 
1, from the foregoing analysis, the following data are on hand: 

Plain. ... ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Cipher... C? I C? M Q V 
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Let the values of Ep already assumed in the remaining alphabets, be set 
down in a reconstruction matrix, as follows: 



Plain 

1 

2 

Cipher 3 

4 

5 




b. It is seen that by good fortune the letter Q is common to Alphabets 
1 and - 5 , and the letter C is common to Alphabets 1 and 4. If it is assumed 
that one is dealing with a case in which a mixed component is sliding against 
the normal component, one can apply the principles of direct symmetry of 
position to these alphabets, as outlined in par. 28. For example, one may 
insert the following values in Alphabet 5 • 



Plain 
Cipher ^ 

5 

c. The process at once gives three definite values: fic * Bp, 

5 5 

Vc - Gp, Ic = Rp. Let these deduced values be substantiated by referring 
to the frequency distribution. Since B and G are normally low or medium 
frequency letters in plain text, one should find that He and Vc, their 
hypothetical equivalents in Alphabet 5, should have low frequencies. As 
a matter of fact, they do not appear in this alphabet, which thus far 

5 

corroborates the assumption. On the other hand, since Ic * Rp, if the 

5 

values derived from symmetry of position are correct, Ic should be of high 
frequency and reference to the distribution shows that Ic is of high fre- 
quency. The position of C is doubtful, it belongs either under Np or Vp. 

5 

If the former is correct, then the frequency of C c should be high, for it 

would equal Npj if the latter is correct, then its frequency snould be low, 

5 

for it would equal V c . As a matter of fact, C c does not occur, and it must 
be concluded that it belongs under Vp. ©iis in turn Betties the value of 
l 

C c , for it must now be placed definitely under Ip and removed from beneath Ap. 

d. The definite placement of C now permits the insertion of new values 
in Alphabet 4, and one now has the following: 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 
C? I C? M Q V 

M Q V C? I C? 
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A B C D E F G 


HIJKLMNOPQRSTUVWXYZ 


I 


C M Q V 


W 

G 

I C 


M Q V 


M Q V 


I C 



31. Subsequent steps in solution. -- a. It is high time that the thus 
far deduced values, as recorded in the reconstruction matrix, be inserted 
in the cipher text, for by this time it must seem that the analysis has 
certainly gone too far upon unproved hypotheses. The following results 
are obtained: 

5 10 15 20 25 30 

A. QWBRI VWY CA ISPJL R B Z E Y Q W Y E U LWMGW^ 

RERTEEE RE E 

B. t IC JCI MTZEI MIBKN QWBRI VWY IG BWNBQ 

E ERO RO RE RTEA E E 

C. QCGQH IWJ K A G E G X N IDMRU VEZYG Q I G V N 

RENEE E E T REP 

D. CTGYO BPDBL V C G X G B K Z Z G I VXCU NTZAO 

IE T E EE 

E. BWFEQ QLFCO MT Y Z T CCBYQ OPD K A G D G I G 

E E R E 0 I E E A 

P. VPWMR QIIEW I C G X G B LGQQ VBGRS MYJJY 

T K R E’" eS Ti E N E T E 0 

G. QVFWY RWNFL G X N F W MCJKX IDDRU OPJQQ 

RE 0 E N E 

S. ZRHCN VWDY Q R D GDG BXDBN PXFPU Y XNF G 

E T E E E 

T. M P J E L S A N C D S E Z Z G I BEYU KDHCA MBJJF 

0 E E E 0 

K. KILCJ MFDZT CTJRD MIYZQ ACJRR SBGZN 

E 0 I 0 E E 

L. QYAHQ VEDCQ LXNCL LVVCS Q W B II IVJRS 

R E T E E E E R E A R E 

it. WNBRI VPJEL TAGDN IRGQP ATYEW CBYZT 

R r E E EN I 

N. EVGQU VPYHL LRZNQ XINBA IKWJ Q R D Z Y F 

ENT E EE 

P. KWFZL GWFJQ QWJYQ IBWRX 
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b. The combinations given are excellent throughout and no incon- 

12 3 

slstencies appear. Note the trlgraph k$SB, vhich is repeated in the fol- 
lowing polygraphs (underlined in the foregoing text): 

123451 5123451 

QWBRIV. . . SQBBIII 
RE RT... RE ARE 

c. The letter Be is common to both polygraphs , and a little imagina- 
tion will lead to the assumption of the value B c * P p , yielding the following: 

123451 5123451 

QWBRIV. . .SQBBIII 
REPORT. . . PREPARE 

. . 4 5 1 2 3 4 

d. Note also (at E29) the polygraph I G V P W M, vhich looks like 

A T K 

the word ATTACK. The frequency distributions are consulted to see whether 

5 2 

the frequencies given for G e and P c are high enough for Tp and A p , 

3 

respectively, and also whether the frequency of W c is good enough for Cp, 

it is noted that they are excellent. Moreover, the digraph which 

l 

occurs four times, looks like TH, thus making B c * H p . Does the insertion 
of these four new values in our diagram of alphabets bring forth any lncon- 

2 1 

slstencies? The Insertion of the value P c * A p and B c * H p gives no indi- 
cations either way, since neither letter has yet been located in any of the 

other alphabets, tfhe insertion of the value G c « T p gives a value common 

3 

to Alphabets 3 and 5, for the value G c ■ Ep was assumed long ago. Unfortu- 
nately an inconsistency is found here. The letter I has been placed two 
letters to the left of G in the mixed component, and has given good results 

3 

in Alphabets 1 and 5; IT the value W c ■ C p (obtained above from the assump- 
tion of the word ATTACK) is correct, then W, and not I, should be the second 
letter to the left of G. Which shall be retained? There has been so far 

3 

nothing to establish the value of G c ■ Ep; this value was assumed from fre- 
quency considerations solely. Perhaps it is wrong. It certainly behaves 
like a vowel, and one may see what happens when one changes its value to Op. 
The following placements in the reconstruction matrix result from the analy- 
sis, when only two or three new values have been added as a result of the 
clues afforded by the deductions: 
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e. Many new values are produced, 

the message, yielding the following: 

5 10 15 

A. QWBRI VWY C A I S P J L 

REPOR T E E E M Y 

B. I_C JCI M T Z E I MIBKN 

E~ S E R 0 R OOP 

C. QCGQH IWJKA G E G X N 

R S 0 N EE ff 0 

D. CTGYO BPDBL V C G X G 

10 HAD TSOT 

E. BWFEQ QLFCO MT Y Z T 

HE E R E 0 ”” 

F. VPWMR QIIEW I C G X G 

TACKF ROM H ITsl) t" 

G. QVFWY RWNFL G X N F W 

R D Q S E G H 

H. ZRHCN V W D Y Q R D G D G 

CE TE ES0T 

J. MPJEL SANCD SEZZG 

0 A C E C T 

K. KILCJ MFDZT CTJRD 

0 E 0 10 

L. QYAHQ VEDCQ LXHCL 

R E T E E E 

M. WNBRI VPJEL TAGDN 

U P 0 R T A 0 

N. EVGQU VPYHL LRZNQ 

DON T A C E 

P. KWFZL GWFJQ QWJYQ 
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MNOPQRSTUVWXYZ] 


M PQRVH 




S I G B C 


M 


I G B C M 


P Q 


P Q R V W 


s 


S I G B C 





and these are inserted throughout 



20 






25 




30 


R B Z E Y 


Q W Y 


E U 


L W 


UGW 


S R 


R E 






E 


weir 


QWBRI 


VWY 


I G 


B W 


N B Q 


REPOR 


T E 




A T 


H E 


D E 


I D M R U 


V E 


Z 


Y G 


Q I 


G V N 


E WO 


T 




T 


R 0 


0 P 


B K Z Z G 


I V 


X 


C U 


N T 


ZAO 


H T 


D 




E 






C C B Y Q 


0 P 


D 


K A 


_G D 


GIG 


ISP E 


A 






G 


OAT 


_B L G Q Q 


V B 


G 


R S 


M Y J J Y 


H ONE 


T R 


0 


0 P 


0 




M C J K X 


I D 


D 


R U 


0 P J Q Q 


0 S 


E 




0 


A 


N E 


B X D B N 


P X 


F 


P U 


Y X N F G 


H D 


Q 




M 




T 


I B E Y U 


K D 


H 


C A 


M B 


J J F 


E R 






E 


0 R 




M I Y Z Q 


A C 


J 


R R 


S B 


G Z N 


0 0 E 


S 




0 F 


C R 


0 


L V V C S 


Q W 


B 


I I 


I V 


J R N 


D B E P 


R E P A R 


E D 


0 


I R G Q P 


A T Y 


E W 


C B 


Y Z T 


E C 0 N D 






H 


I R 




X I N B A 


IKWJfi 


R D 


Z Y F 


0 D 


E 




E 


S 




I B W R X 
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32. Completing the solution. --a. Completion of solution is now 
a very easy matter. The mixed component is finally found to be the 
following sequence, based upon the word EXHAUSTING: 

EXHAUSTINGBCDFJKLMOPQRVWYZ 



The completely reconstructed enciphering matrix is shown in Fig. 19. 



Plain 

Cipher 



1 

2 

3 

4 

5 



ABCDBFOHIJKLMNOPQBSTUVWXYZ 
AUSTINGBCDFJKLMOPQRVWYZEXH 
PQRVWYZEXHAUSTINGBCDFJKLMO 
R V W Y ZEXHAUSTINGBCDFJKLMOPQ 
INGBCDFJKLMOPQRVWYZEXHAUST 
LMOPQRVnZEXHAUSTIHGBCDFJK 



Figure 19. 

b. Note that the successive equivalents of Ap spell the word APRIL, 
which~is the key for the message. The plaintext message is as follows: 

REPORTED ENEMY HAS RETIRED TO NEWCHESTER. ONE TROOP IS REPORTED AT 
HENDERSON MEETING HOUSE. TWO OTHER TROOPS IN ORCHARD AT SOUTHWEST EDGE OF 
NEWCHESTER. SECOND SQ IS PREPARING TO ATTACK FROM THE SOUTH. ONE TROOP 
OF THIRD SQ IS ENGAGING HOSTILE TROOP AT NEWCHESTER. REST OF THIRD SQ IS 
MOVING TO ATTACK NEWCHESTER FROM THE NORTH. MOVE YOUR SQ INTO WOODS EAST 
OF CROSSR/OADS7 FIVE THREE NINE AND BE PREPARED TO SUPPORT ATTACK OF SECOND 
AND THIRD SQ. DO NOT ADVANCE BEYOND NEWCHESTER. MESSAGES HERE. 

TREER, COL. 

c. The preceding case is a good example of the value of the principles 
of direct symmetry of position when applied properly to a cryptogram en- 
ciphered by the sliding of a mixed component against the normal. The crypt- 
analyst starts off with only a very limited number of assumptions and builds 
up many new values as a result of the placement of the few original values 
in the reconstruction matrix. 

33. Solution of subsequent messages enciphered by the same cipher 
component. — a. Let it be supposed that the correspondents are using the 
same basic or primary components but with different key words for other 
messages. Can the knowledge of the sequence of letters in the reconstructed 
mixed primary component be used to solve the subsequent messages? It has 
been shown that in the case of a monoalphabetic cipher in which a mixed al- 
phabet was used, the process of completing the plain-component sequence 
could be applied to solve subsequent messages in which the same components 
were used, even though the cipher component was set at a different key 
letter. A modification of the procedure used in that case can be used in 
this case, where a plurality of cipher alphabets based upon sliding primary 
components is used. 

b. Let it be supposed that the following message passing between the 
same Bro correspondents as in the preceding message has been intercepted: 
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SFDZR 


YRRKX 


MIWLL 


AQRLU 


RQFRT 


LJQKF 


XUWBS 


MDJZK 


MICQC 


UDPTV 


TYRNH 


TROKV 


BQLTI 


QBNPR 


RTOHD_ 


PTIVE 


RMGQN 


LRATQ 


PLUKR 


KGRZF 


JCMGP 


IHBMR 


GQRFX 


BCABA 


OEMTL 


PCXJM_ 


RGQSZ 


VB 







c. The presence in this size sample of a tetragraphic repetition 
whose - interval is 21 letters suggests a key word of three or seven letters; 
the repeated trlgraph at an interval of 28 nakes seven as the more probable 
hypothesis. There are very few other repetitions , and this is to be ex- 
pected in short messages with a key of such length. 

d. Let the message be written in groups of seven letters, in columnar 
fashion, as shown in Fig. 20a. The letters in each column belong to a 
single alphabet. Let the first ten letters in each column be converted 
into their plain-component equivalents by setting the reconstructed cipher 
component against the normal plain component at any arbitrarily selected 
point, such as in the following alphabet: 

Plain: ABC0EFGH1 

Cipher: EXHAUSTIB 

The columns of equivalents are zu 

12 3 4 5 6 7 

SFDZRYR 
RKXHIWL 
LAQSLUR 
QFRTI JQ 
K F X U W B S 
NDJZKN1 
CQCDDPT 
TTYRJHT 
RORTBQL 
TIQBIPR 
RTDHDPT 
I V E R M G Q 
ILRATQP 
LDKRKGR 
Z F J C M G P 
IHSMRGQ 
R F X B C A B 
A 0 E M T L P 
CXJMRGQ 
S Z V B 

Figure 20a. 

e. It has been shown that J 
volving a mixed cipher component 
mal alphabetic sequence beneath the plain-component equivalents and all the 



JKLMBOPQRSTUVWXYZ 

GBCDFJKLMOPQRVWYZ 

ow as shown in Fig. 20b. 



1 

F 

V 
Q 
U 
P 
R 
L 
W 

V 
G 



2 3 

B N 
P B 
D U 
B V 
H B E 
M 0 Z 
U L E 
GIV 
S V w 
HUE 



5 6 7 

V Y V 
H X Q 
Q E V 
H 0 U 
K F 
R H 
T G 
C G 
U Q 
T V 



Figure 20b. 



in the case of a monoalphabetic cipher in- 
it was merely necessary to complete the nor* 
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plain text reappeared on one generatrix. It was also found that in the 
case of a polyalphabetic cipher involving standard alphabets, the plain- 
text equivalents of each alphabet reappeared on the same generatrix, and 
it was necessary only to combine the proper generatrices in order to 
produce the plain text of the message. In the case at hand both processes 
are combined: the normal alphabetical sequence is continued beneath the 

letters of each column and then the generatrices are combined to produce 
the plain text. The generatrix diagrams for the first five alphabets (i.e., 
columns) are shown in Fig. 21, below. Only the first ten letters in each 
generatrix are used in the diagrams, since the application of the generatrix 
elimination and rough scoring procedures discussed in pars. 21f and £ will 
yield a solution. 



Gen. Alphabet 1 

SRLQSKMCVBT 

1 1 FVQPFRIATVG 

2 QWRv qae wa - 

3 HXSWRINYXI 

4 - HTX 6 H0ZYJ . 

5 j a rewPA SK- 

6 KAVZUWftBAL 

7 2 LBWAVXRCBM 

8 2 MCXBWYSDCN 

9 MDYCXaT B D e- 

10 4 OEZDYAUFEP 

11 PFAEZBVGF fr- 

12 2 QGBFACWHGR 

13 3 RHCGBDXIBS 

14 5 SIDHCEYJIT 

15 TJBIDFZKJU - 

16 - UKFJBG A M V- 

17 0 VLGKFHBMLW 

18 2 WMHLGICHMX 

19 SSIMaJDOMY 

20 Y0JKIKK F9 Z - 

21 ZFKOJLFQPA 

22 A q tiFKMGflqB -- 

23 4 BRMQJ.RHSRC 

24 7 CSKRMOITSD 

25 6 DTOSNPJUTE 

26 EUPTOQ^VUF 



Alphabet 2 

FKAFFDQTOI 
4 NPDNNMUGSH 
7 0QE00NVHTI 

3 PRFPPCWIUJ 
QSGQQPXJVK 
RT8RRQYKWL 
6 U - I SS RZLXM - 

6 TVJTTSAMYN 
UWKUUTBNZO 

2 VXLWUCOAP 
0 WYMWWVDPBQ 

■ XZMfo t WE Q OR - 

4 YAOYYXFRDS 
ZBFZZYG S ET 
AS^AAZHTFU ■ 

3 BDRBBAIUGV 
2 CESCCBJVHW 

DFTBDCKW - B t- 



■- FHVFF E MHta - 

3 GIWGGFKZLA 
BJXHHGOA tft- 

4 IKYIIHPBNC 
JhZJJIQGO B- 
KMAKKJRDPB 
LNBLLKOB ^F- 

3 MOCMMLTFRG 



Alphabet 3 
DXQRXJCYRQ 
1 MBUVBOLYVU 
1 NCVWCPMZWV 

-eam o pueob 

PEXYSROBYX 
QFYZF6P02Y ' 
RGZAGTQDA2 - 
5 SHABHUREBA 
4 TIBCIVSFCB 
- UJGDJWTODO 
VKDEKXUBTO - 

3 WLEFLYVIFE 
XMPGMZWJGP 
YMGHNAXKHG - 

4 ZOHIOBYLIH 
APUPCZMJI - 



Alphabet 4 
ZMRTUZURVB 



Alphabet 5 
RILIWKDHBN 



gHVQBBEVWK - VHQHXIMIKI 



3 ASWHFAEWXL 
B B CIG B9 XYM - 
gUYJHOHYZK 

■ BVZKIDIZAO - 
EWALJEJABP 

■ FXBM K FKBOQ - 

2 GYCNLGLCUR 

3 HZDOMHMDES 
8 IAEPHINEFT 

JBTQPJQFGU 

KCGRFKPGHV - 



MEIIBMRIJX 

HFJUSK S3 KY 



- B^B EQ PA WSJ - OGKVTO f ggjZ - 
1 PHLWUPULMA 

5 RJNYWEWUOC 



CKKLREBOM- 
2 DSLMSFCPML 

5 ETMNTGDQRM 

6 FUNOUHERON 

4 GVOFVIFSPO 

- IXQRXKBUR Q 

5 JYRSYLIVSR 
■ KE B T E MJW BB 
LATGAKKXUT 



4 TLPAYTYPQE 

6 VKRCAVARSG 
4 WOSDBHBSTH 

- XPTBCXCTUI 

- YQGFDYDtfV J- 



WIRIY Q RJLJ - 

XJSjanOKMK - 

YKHCABPLHL 

ZLULDTq W M t " 

3 AMVMCURNPN 
5 BHWNDVSOQO 
5 COXOEWTFRP 

DPYPFXU^ fr- 

s&WPfsm- 

5 FRARHZWSUS 

6 GSBSIAXTVT 
2 HTCTJBYUWU 

Knwi c czvxv - 

2 JVEVLDAWYW 
KWFW M B B XZ X- 
LXCXKFCYAY 
MYHYOGDZBZr ■ 
HZIZFHEA BA- 
OAJAQIFB BB- 
■ PBKB R JGCE G— 
^ OLOGKHDPB - 
5 RDMDTLIBGE 

4 SEHEUMJFHF 
4 TFOFVHKGIG 
1 UGPGWOLHJH 



Figure 21. 



f . A trial of the generatrices with the highest scores in the first 
three~alphabets yields the trigraphs shown in Fig. 22a. The generatrices 
of the subsequent columns are examined to select those which may be added 
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results are shown in Fig. 22b. 

12 3 
C 0 F 
S Q U 
KES 
R 0 0 
M 0 U 

0 N H 

1 V E 
T H R 
S T 0 
DIN 



The 

the correct 

12 3^567 
C 0 F I R S T 
S Q U A D R 0 
N E N E M Y T 
R 0 0 P D I S 
MOUNTED 

0 N H I L L F 

1 V E N I N E 
T H R E E W E 
S T 0 F G 0 0 
D I N T E N T 



to those already selected in order to build up the plain text 

Note that, in this case 



Figure 22a. Figure 22b. 



generatrix for Alphabet 5 is not the one with the highest score (6), but 
one of the four generatrices vith a score of 5» The generatrix process is 
a very valuable aid in the solution of messages after the primary components 
have been recovered as a result of the longer and more detailed analysis of 
the frequency distributions of the first message intercepted. Very often a 
short message can be solved in no other way than the one shown, if the pri- 
mary components are completely known. 



g. It may be of Interest to find the key word for the message. Assum- 
ing that enciphering method number 1 (see par. 13f, page 20) were known to 
be employed, all that is necessary is to set the mixed component of the 
cipher alphabet underneath the plain component so as to produce the cipher 
letter indicated as the equivalent of any given plaintext letter in each of 
the alphabets. For example, in the first alphabet it is noted that Cp = S c . 
Adjust the two components under each other so as to bring S of the cipher 
component beneath C of the plain component, thus: 



Plain: ABCDEFGHIJKLMNOPQRS'IUVWXYZ 

Cipher: EXHAUSTINGBCTFJKLMOPQRVWY ZEXHAUS TINGBCDFJKIJ40PQRVWYZ 

It is noted that Ap * Ac. Hence, the first letter of the key word to the 
message is A. The 2d, 3d, kth,...7th key letters are found in exactly the 
same manner, and the following is obtained: 



When C 0 F I R 3 T equals 

S F D Z R Y R then Ap successively equals 
AZIMUTH 



34. Statistical methods for the determination of correct generatrices. 
—a. The student has seen the advantages of the simple two-category 
weighting procedure , as demonstrated in subpars. 21f and g, over the method 
of ocular inspection. These advantages are that, first of all, the two- 
category weighting system is very easy to apply mentally, and, secondly, 
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almost any scoring system will be more accurate and measurable than will 
a mere "appraisal" by eye which may be rather subjective or intuitive in 
nature. This second point is especially true when the number of letters 
in the generatrices is small, that is, around 10 letters or so. 

b. Instead of the system of two-category weights, it is possible to 
use the sunnation of the relative frequencies of plaintext letters to 
evaluate generatrices. For convenience in assigning whole numbers as the 
frequencies, the following scale (summing to 100 ) has been used: 

7 13 413 3 23700l>28830869322020 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 

nils system is only a trifle more sensitive than the two-category system, 
but the convenience of only two categories for mental arithmetic is lost. 
Besides, the two-category system actually involves ratios of the frequencies 
of the two classes of letters and in effect gives a multiplication of the 
weights of a generatrix, whereas the summation of the plaintext frequencies 
involves an addition of these frequencies which is not a precise mathematical 
measure of the relative goodness of a generatrix. The summation of the 
relative frequencies of letters takes into account only the probability of 
occurrence of each letter in the generatrix, considered separately; that is, 
the occurrence of an E has a value of 13, regardless of whatever other letters 
are present in the same generatrix, and this value is added to the frequencies 
of the other letters. ~ 

c. If instead of the summation of the arithmetical frequencies, 
logarithms of the frequencies are used and these logarithms are added together, 
then a true picture of the generatrix is obtained. The reason underlying 

this fact is that the summation of logarithmic weights is equivalent to 
multiplying the probabilities of occurrence of all the letters in the gen- 
eratrix taken together, thus giving an accurate evaluation of the genera- 
trix as a whole . This method is especially valuable when generatrices con- 
tain as few as 5 or 6 letters. As an aid to the solution of problems where- 
in the plain component is a standard alphabet, a set of strips has been 
printed containing the normal sequence and the respective logarithmic weights 
over each letter. (If the plain component is any other sequence, strips 
would have to be prepared manually with that particular sequence inscribed.) 

The logarithmic weights on these strips are as follows: 

84779657812768862889655360 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

The numbers on these strips are one -digit logarithms (to the base 133) of the 
relative frequencies of English plaintext letters as found in Table 3, Appen- 
dix 2 , Military Cryptanalytics , Part I . For the interested student, the deri- 
vation of these one-digit logarithms will be discussed in the next two sub- 
paragraphs . 

d. Let the following table be examined. Column (a) represents the 
•uniliteral frequencies on a basis of 1000 letters; column (b) represents the 
logarithms (to the base 10) of these frequencies; column (c) contains the 
figures of the preceding column with the addition of .009 to each logarithm, 
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column (d) is a conversion of the basic frequencies in column (a) to 
two-digit logarithms (base 133)} and column (e) 1 b a one-digit logarithmic 
weight based on the logarithms of the preceding column. 



0 ] 




73. 7 


n<r<w 


1.877 




9-7 


0.987 


0.996 


.41 


30.7 


1.487 


1.496 


.70 


42.4 


1.628 


1.637 


.76 


130.0 


2.113 


2.122 


.99 


28.3 


1.452 


1.461 


.68 


16.4 


1.214 


1.223 


.57 


33.9 


1.530 


1.539 


•72 


73-5 


1.866 


1.875 


.87 


1.64 


0.214 


0.223 


.12 


2.96 


0.471 


0.480 


.22 


36.4 


1.560 


1.569 


•73 


24.7 


1.392 


1.401 


.65 


79.5 


1.900 


1.909 


.89 


75.3 


1.875 


1.884 


.88 


26.7 


1.427 


1.436 


.67 


3.50 


0.544 


0.553 


.26 


75.8 


1.880 


1.889 


.88 


61.2 


1.787 


1.796 


.84 


91.9 


1.963 


1.972 


.92 


26.0 


1.415 


1.424 


.66 


15.3 


1.184 


1.193 


.56 


15.6 


1.192 


1.201 


.56 


4.62 


0.664 


0.673 


• 31 


19.3 


1.285 


1.294 


.61 


.98 


0.991-10 


0.000 


.00 




e. Hie addition of .009 to the common logarithms is for the purpose 
of transforming the letter of the lowest frequency (Zp) to the value of 
.000 for convenience; this addition (which is equivalent to an arithmetic 
multiplication) does not change the ratios between the basic frequencies. 
Now the highest frequency (Ep) is given the value .99 and all the other 
logarithms are scaled proportionally down to Zp which is 0: this is 

equivalent to expressing the frequencies in logarithms with a base other 
then 10, which in this case is 133. The new base (C) used to convert each 
of the uniliteral frequencies to the logarithmic range 0 to O.99 is derived 
as follows, when 130 is the highest frequency (Ep) : 

Let 130 - C 0 99 
Logl 0 130 - Log 10 C°" 

Log 10 13O * (0.99) (Log 10 C) 



Antilog Log, 



Antilog 2.122 
0.99 
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The formula for the computation of the logarithm to the new base (C) 
of any actual frequency (Y) of a series is: 



Log c Y ■ Log 10 Y 
Logjo 0 

It is more convenient to use reciprocals in the conversion of a whole 
series of logarithmic values, as in this instance. The formula is: 

(LogjoYXLogjoC)' 1 • Log c Y 

After these two-digit logarithms are derived, they are converted into one- 
digit logarithms by multiplying them by 10, dropping the single decimal. 1 

f . As an example of the application of these logarithmic weights, 
let us* consider the generatrices of Alphabet 5 in Fig. 21. In this example , 
Generatrix Ho. 12 (an Incorrect generatrix) had a two-category score of 6, 
and Generatrix Nos. 7 , 6, 11, and 23 had scores of 5. If logarithmic weights 
had been used, these generatrices would have had the following scores: 2 



Gen. 12: GSBSIAXTVT 

5848883959* 67 
Gen. 7: BNWNDVSOQO 

4858758828 - 63 

Gen. 8: COXOEWTPRP 

7838959686 - 69 
Gen. 11: FRARHZVJSUS 

6888705868 - 64 
Gen. 23: RDMDTLIEGE 

8767978959 - 75 

The results clearly point to Generatrix No. 23 as the correct generatrix. 
Even if these generatrices had contained only six letters instead of 10, 
the logarithmic weights would have pointed to the correct generatrix. 



1 Logarithms multiplied by 10 are called decibans , logarithms multiplied by 100 are called centibans 
Logarithmic weights are usually expressed in decibans or centibans for convenience in treatment as integral 
values 

2 

It is interesting to determine what is the numerical expectation of the sum of the logarithmic weights 
for correct generatrices, as well as the expectation for incorrect ones--m other words, a sort of logarithmic 
4 test The expected value for the correct (1 e plaintext) generatrices is calculated by multiplying the 
logarithmic weights by the probabilities of each letter, summing the results, this sum is then multiplied by 
the number of letters in the generatrix to give the expected value of the sum of the logarithmic weights 
for the generatrix The random expectation is the sum of the logarithmic weights in the scale (151) divided 
by 26 multiplied by the number of letters in the generatrix. Thus the plaintext expectation is 7 6N and 
the random expectation is 5 8N, where N is die number of letters in the generatrix 
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g. In order to illustrate the degree of refinement between loga- 
rithmic weights and the arithmetical frequency weights mentioned in 
subpar. 3^£, let vis consider the following case. Below are the best 
generatrices from the first three alphabets of a seven -alphabet poly- 
alphabetic cipher; the number at the left of the generatrices is the sum 
of the arithmetical weights, while the number to the right is the sum of 
the logarithmic weights. 





Alphabet 1 






Alphabet 2 






Alphabet 3 




40 


OIAGNN 


45 


40 


Z 0 T W E N 


39 


32 


HNHZTN 


39 


37 


S M E K R R 


4l 


35 


ODILTC 


46 


31 


CICUOI 


hk 


36 


TNFLSS 


46 


32 


D S X A I R 


42 


31 


HSMBIS 


43 


34 


B V N T A A 


42 








31 


0 U 0 G A U 


4l 


33 


U 0 G M T T 


43 








29 


S Y S K E Y 


39 



It will be seen that, although the generatrix OIAGNN in Alphabet 1 has 
the highest arithmetic sum, nevertheless the most probably correct 
generatrix as shown by the logarithmic weights is TNFLSS. In Alphabet 
2, the generatrix ODILTC has the highest probability of being the correct 
one; and in the third alphabet the logarithmic sum points to CICUOI as the 
most likely generatrix. 3 These generatrices when Juxtaposed yield the 
following plaintext fragments, attesting to the validity of the selection: 

TOC. • . . 

N D I . . . . 

F I C . . . . 

L L U . . . . 

S T 0 . . . . 

SCI. . . • 

h. In difficult cases wherein generatrices contain very few letters, 
one more statistical resource is available to the cryptanalyst. Suppose 
that in a certain short cryptogram the number of letters in each alphabet 
is only four, and that in this particular case the generatrix RTIS is 
selected from the generatrices for Alphabet 1. In Alphabet 2, the genera- 
trices EINP, IMRT, and PTYA (logarithmic weights of 31, 31, and 29, 
respectively) appear to be the most likely candidates for the correct 
generatrix. The generatrix RTIS is Juxtaposed against the three genera- 
trices of the second alphabet, and now we record the logarithmic weights 4 

q 

In Alphabet I, the difference between the logarithmic scores between OIAGNN (46) and TNFLSS (46) 
shows that the latter generatrix is 133 *=16 times better than the first generatrix, in Alphabet 2 the dif- 
ference (7) between the logarithmic scores of Z.OTWEN and ODILTC shows that the latter is 133 ^ = 31 times 
better than the first generatrix, and in Alphabet 3, the difference (5) between the logarithmic scores of 
HNHZTN and CICUOI shows that the latter is 133 ® = 11 times better than the first generatrix 

4 These weights are taken from Table 15, Appendix 2, Military Cryptanalytics Parti The table gives 
two-digit logarithms to the base 224 of the digraphic frequencies of plain text, for convenience, these log- 
arithms are treated here as centibans by dropping the decimal point This logarithmic method is much more 
precise then a method wherein only the digraphic frequencies are used to obtain a score 
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of the digraphs thus formed, as follows: 



RE 


96 


HI 75 


RP 


59 


TI 


82 


TM 45 


TT 


67 


IN 


92 


IR 73 


IY 


0 


SP 


J1 

335 


ST 88 
251 


SA 


Jk 

197 



The logarithmic score of 335 points to the generatrix EINP as the most 
probable for Alphabet 2. Thus the selection of the correct generatrices 
has been reduced to a purely statistical basis which is of great assist- 
ance in effecting a quick solution. Moreover, an understanding of the 
principles involved will be of considerable value in subsequent work. 

35 « Solution by the probable -word method. — a. Occasionally one may 
encounter a cryptogram which is so short that it contains no recurrences 
even of digraphs, and thus gives no indications of the number of alphabets 
Involved. If the sliding mixed components are known, one may apply the 
methods illustrated in par. 22, assuming the presence of a probable word, 
checking it against the text and the sliding components to establish a 
key, if the correspondents are using key words. 

b. For example, suppose that the presence of the word ENEMY is as- 
sumedin the message in subpar. 33b above. One proceeds to check it against 
an unknown key word, sliding the already-reconstructed mixed component 
against the normal and starting with the first letter of the cryptogram, 
in this manner: 



When ENEMY equals 

SFDZR then Ap successively equals 
XENFW 

The sequence XEMFW spells no intelligible word. Therefore, the location 
of the assumed word ENEMY is shifted one letter forward in the cipher text, 
and the test is made again, just as was explained in subpar. 22d. When 
the group AQRLU is tried, the key letters ZIMUT are obtained, which, taken 
as a part of a word, suggest the word AZIMUTH. The method must yield 
solution when the correct assumptions are made. 

c. The placement of probable words in polyalphabetic ciphers may be 
facilitated by considering (l) the frequency patterns of the letters com- 
posing cribs, and (2) the partial idiomorphismB which may be produced in 
the periodic encipherment of certain cribs. 

(l) For instance, in the first case, the plaintext frequency pattern 
of the word CAVALRY has a distinctive relative high- (H), medium- (M), and 
low-frequency (L) pattern of MHLHMHL; if the individual monoalpbabetic 



5 The generatrix EINP is better than IMRT by a factor of 224 (3 35-2 81 > =224°* 54 =18, likewise, the 
generatrix EINP is better than PTYA by a factor of 224^ 35-1 =224* 38 =1712 

8 ? 
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frequencies of a periodic cipher are written over the cipher letters 
of a cryptogram, possible placements for the word CAVALRY might be seen. 

It is important to note that, although the frequencies of high- and medium- 
frequency plaintext letters might be distorted in a polyalphabetic 
cryptogram, it is not expected that low- frequency letters will be changed 
appreciably, therefore these low-frequency letters are a more accurate 
guide to crib-placing than are the other letters. It goes without saying 
that polygraphic repetitions may be used as a basis on which to assume 
probable words, depending on the length of the polygraphs; these repetitions, 
together with the frequency pattern of the cipher letters composing the 
repetitions, form one of the most valuable means of plaintext entries in 
a cryptogram. 

(2) The aspect of partial idiomorphism is based on the fact that, 
if there is a pair of repeated letters at a distance of N in a plaintext 
word, this idiomorphism will show through in the cipher when there has been 
a polyalphabetic encipherment of a period of N. For example, if the word 
DIVISION is enciphered by a polyalphabetic substitution of four alphabets, 
the first and third Ip must of necessity be represented by the same cipher- 
text equivalent. Thus if in a four -alphabet system an A. ..A pattern is 
found in the cipher text, reference may be made to compilations of words 
containing like letters repeated at various intervals,® and under the 
listing of "A(3)A" will be found DIVISION, among other words, which may be 
used as possible assumptions. 

36 . Solution when the plain component is a mixed sequence, the cipher 
componint, the normal. --^al This falls under Case lib outlined in par. b. 

It is not the usual method of employing a single mixed component, but may 
be encountered occasionally in cipher devices. 

b. The preliminary steps, as regards factoring to determine the 
length of the period, are the same as usual. The message is then tran- 
scribed into its periods. Frequency distributions are then made, as usual, 
and these are attacked by the principles of frequency and recurrence. An 
attempt is made to apply the principles of direct symmetry of position as 
demonstrated thus far, but this attempt will be futile, for the reason 
that the plain component is in this case an unknown mixed sequence. (See 
par. 28d.) Any attempt to find symmetry in the secondary alphabets based 
upon the normal sequence can therefore disclose no symmetry because the 
symmetry which exists is based upon a wholly different sequence. 

c. However, if the usual principles of direct symmetry of position are 
of no~avail in this case, there are certain other principles of symmetry 
which may be employed to great advantage. To explain them an actual example 
will be used. Let it be assumed that it is known to the cryptanalyst that 



® In this connection, see Appendix 2 
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the enemy is using the general system under discussion, viz., a mixed 
sequence, variable from day to day, is used as plain component; the 
normal sequence is used as cipher component; and a repeating key, vari- 
able from message to message, is used in the ordinary manner. 

The following message has been intercepted: 



5 


10 


15 


20 


E V N T T? 


3? 


A. QIOVK 


L R M L Z 


J V G T G 


mvK 


ERHUE 


B. V R Z M 0 


Y A A M P 


D K E I J 


SFMYO 


YEMHE 


GQAKB 


C. U Q A X R 


H U F B U 


K Q Y M U 


HELVT 


K Q I L E 


K Z B U E 


D. U L I B K 


N D A X B 


X U D G L 


L A D V K 


P 0 A Y 0 


DKEYE 


£. L A D H Y 


B V II F V 


U E E M E 


FFN1E 


0 V W B Y 


T V D Z L 


F. S P B H B 


X V A Z C 


U D Y U E 


L K KM A 


E U D D K 


NCFSE 


G. IS All 


THGUJ 


H Q X P P 


D K 0 U E 


X U Q V B 


F V W B X 


H. N X A L B 


TCDLH 


I V A A A 


N S Z I L 


0 V W V P 


Y A G Z L 


J. SHMHE 


GQDEO 


Y H I V P 


HCRRE 


X K D Q Z 


G K N C G 


K. HQGUI 


J I W Y Y 


T M A H W 


X R L B L 


0 A D L G 


H Q G U Y 


L. J U U G B 


J H R V X 


E R F L E 


G V G U 0 


X E D T P 


D K E I Z 


M. V X N W A 


F A A N E 


MKGIB 


S S N L 0 


K J C B Z 


T G G L 0 


N. P K M B X 


H G E R Y 


1HHLZ 


N Q C Y Y 


T K W I P 


D K A T E 


P. FLHDJ 


HDTVX 


J R Z T L 


0 P A H C 


DFZYY 


D E Y C L 


Q. G P G T Y 


T E C X B 


H Q E B R 


KTHMU 


SING J 


IQDLP 


R. J K A T E 


G U W B R 


H U Q W H 


V R Q B W 


Y R F B F 


K M W M B 


S. T M U L Z 


L A A H Y 


JGDVK 


L K R R E 


XKNAO 


N D S B X 


T. X C G Z A 


H D G T L 


V K M B W 


I S A U E 


F D N W P 


SLZI J 


V. S R Q Z L 


ATIIL 


G V W V K 


FIGEP 


G E C Z U 


KQAP 



d. A study of the repetitions and of the factors of their intervals 
discloses that five alphabets are involved. Unillteral frequency distribu- 
tions are made and are shown in Fig. 23a: 



Alphabet 1 

^ I g g g g 5 I 1 g - ! s % gill 1? 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Alphabet 2 

= % ^ ____ g » 

abcdIfghijklmnopqrstuvwxyz 



Alphabet 3 

2 as a* 

g g g § 5 g 

g a § I g I g 5 ^ g || sj §S-.-.as g ^ 5 g 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

89 
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Alphabet h 

1 g g g .. 

=* g % - -sll ll> ^3s.i?l5Sg| 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Alphabet 5 

g =» 

g g s g § g g ^ 

ggss g-.S— g g g 5s gg 5 > I > 5 ? ? I 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Figure 23a. 

e. Since the cipher component in this case is the normal alphabet, 
it follows that the five frequency distributions are based upon a sequence 



which is known, and therefore, the five frequency distributions should 



manifest a direct symmetry of distribution of crests and troughs . By 
virtue of this symmetry and by shifting the five distributions relative 
to one another to proper superimpositions, the several distributions may 
be contained into a single unillteral distribution. Note how this shifting 
has been done in the case of the five illustrative distributions: 

Alphabet 1 

-- iinisiiiNis!!. gggg ii 

ABCDEFGHIJ KLMNOPQRSTUVWXYZ 

Alphabet 2 

= -3 lllsslssiu ^ 5 I I § 

XYZABCDEFGHIJKLMNOPQRSTUVW 

Alphabet 3 

3 ss 

§ g ^ g g 

TUVWXYZABC DEFGHIJKLMNOPQRS 

Alphabet 4 

^gg «. «* g g g g 

.. S ? | gg 

OPQRSTUVWXYZABCDEFGHIJKLMN 

Alphabet 5 



g— § g *5g =sg 

5 .~g-.3:ggggg! ! g,^ $ ^ ggg^ gg 

R, STUVWXYZABCDEFGHIJKLMNOPQ 

Figure 23b. 
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vwii XLnjii imjuj 



f. The super imposition of the respective distributions enables one 
to convert the cipher letters of the five alphabets into one alphabet. 
Suppose It is decided to convert Alphabets 2, 3, b, and 5 In terns of 
Alphabet 1. It is merely necessary to substitute for the respective let- 
ters In the four alphabets those which stand above them in Alphabet 1. 

For example, in Fig. 23b, Xc In Alphabet 2 is directly under Ac in Alpha - 

” 2 1 

bet 1; hence, if the super imposition is correct then Xc * Ac. Therefore, 
in the cryptogram it is merely necessary to replace every Xc in the second 
position by Ac. Again T c in Alphabet 3 ■ Ac in Alphabet 1; therefore in 
the cryptogram one replaces every T c in the third position by Ac. The 
entire process, hereinafter designated as conversion into monoalphabetlc 
terms, gives the following converted message! 



5 

A. QHVIT 

B. V U G Y X 

C. UTHJA 

D. U 0 P E T 

E. LDKTH 

F. S S I T K 

G. H V H T H 

H. N A H X K 

J. 3 K T Y H 

K. BTIGE 

L. J X B S K 

M. V A U I J 
H. PITIG 

P. F 0 U G S 

Q. G S B F B 

R. JIIFI 

S. T P B X I 

T. X F H L J 
V. S U X L U 



10 

L U T X I 
Y D H Y Y 
H X M H D 
HGHJK 
B Y U R E 
XYHLL 
TPIGS 
TFKXT 
G T K T X 
J L D K H 
J K Y H G 
FDEZI 
H J L D H 
NGAEG 
T H J J K 
G X D I A 
LDETE 
HGHFU 
AYUTD 



15 

JYH7P 
DILUS 
K T F Y D 
XXK3U 
UELII 
U G F G E 
ETEBY 
I Y H H J 
YKPHY 
T P H T F 
EUHXB 
Nil IX 
T P D X I 
J U G F U 
ETLIA 
E X X I V 
JJKET 
V H T H F 
GYDHI 



20 

H 0 S H T 
SITKX 
IHSEC 
LDKST 
FITFH 
LITIJ 
DIVGI 
ITGUU 
H F Y D N 
XUSIU 
GZIGX 
S V U X X 
ITJKE 
OSETL 
X Y D Y D 
V U X R F 
L1YDI 
IVEGI 
FLITY 



25 

E Y U F H 
YKTYI 
E1PXI 
PREKX 
G Y D H H 
E X K P T 
XXXSK 
0 Y D H Y 
XHKCI 
ODKXP 
X H K F Y 
KHJII 
T P D U Y 
DIGKE 
ILU3S 
YUHBO 
XIUHX 
F G U I Y 
G H J L D 



30 

EUTG1 
GIEYK 
XCIGI 
DHRKT 
TYKLD 
H F M E Q 
FYDHG 
Y D E L U 
G B U 0 P 
I1IGE 
DILDI 
TJNXX 
DIBFI 
D E F 0 U 
ITKXI 
KPDIK 
HGZIG 
BOGUS 
K1SB 



The uniliteral frequency distribution for this converted text follows. Bote 
that the frequency of each letter is the sum of the five frequencies in the 
corresponding columns of Fig. 23b. 



g § 




ABC DEFGHIJKLMNOPQRSTUVWXYZ 



7 6 I 31 7 80 86M182188228609 1i2 3X9 488813 89 XI 8 

Figure 2k. 
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,g. The problem having been reduced to monoalphabetic terms, a tri- 
literal frequency distribution can now be made and solution readily at- 
tained by simple principles. It yields the following: 



JAPAN CONSULTED GERMANY TODAY ON REPORTS THAT THE COMMUNIST INTER- 
NATIONAL HAS BEHIND THE AMAZING SEIZURE OF GENERALISSIMO CHIANG KAI SEEK 
IN CHINA. TOKYO ACTED UNDER THE ANTICOMMUNIST ACCORD RECENTLY SIGNED BY 
JAPAN AND GERMANY. THE PRESS SAID THERE HAS INDISPUTABLE PROOF THAT THE 
COMINTERN INSTIGATED THE SEIZURE OF GENERAL CHIANG AND SOME OF HIS GEN- 
ERALS. MILITARY OBSERVERS SAID THE COUP WOULD HAVE BEEN IMPOSSIBLE UN- 
LESS GENERAL CHANG H5UEN LIANG HOTHEADED FORMER WAR LORD OF MANCHURIA 
HAD FORMED AN ALLIANCE WITH THE COMMUNIST LEADERS HE WAS SUPPOSED TO BE 
FIGHTING. SUCH AN ALLIANCE THESE OBSERVERS DECLARED OPENED UP A RED ROUTE 
FROM MOSCOW TO NORTH AND CENTRAL CHINA. 



h. The reconstruction of the plain component is now a very simple 
matter. It is found to be as follows: 

HYDRAULICBEFGJKMNOPQSTVWXZ 

Note also, in Fig. 23b, the key word for the message, (HEAVY), the letters 
being in the columns headed by the letter H. 

1. The solution of subsequent messages with different keys can now 
be reached directly, by a simple modification of the principles explained 
in pen:. 28 . This modification consists in using for the completion sequence 
the mixed plain component (now known) instead of the normal alphabet, after 
the cipher letters have been converted into their plain -component equiva- 
lents. Let the student confirm this by experiment. 

J_. The probable -word method of solution discussed under par. 22 is 
also applicable here, in case of very short cryptograms. This method pre- 
supposes, of course, possession of the mixed component and the procedure is 
essentially the same as that in par. 22. In the example discussed in the 
present paragraph, the letter A on the plain component was successively set 
against the key letters HEAVY; but this is not the only possible procedure. 



A n interesting technique is possible at this point to recover die key word for the plain component from 
the composite umliteral frequency distribution of die cipher text at one fell swoop if the plain component is 
a keyword-mixed sequence Note the distribution in Fig 24 If this represents the "profile'' of a keyword- 
mixed sequence then it appears that die key word begins at D c with the letters Zc A c B 0 C c being the 
equivalents of four of th e five plaintext letters V WXYZ Q c and Rc are obviously Jpand Kp respectively, and 
W c = Qp The sequence STUV C represents either LNOF^ or MNOf^, XTfc must be two of the letters RSTp. If 
N c = Ep then OP c = F<^, M c is probably Bp thus delineating the key word of 9 letters beginning at Efe From 
this analysis it can be conjectured that the key word contains the letters A, C, D, H, I, U, one from the 
group LM one from the group RST and probably Y (for a more likely percentage of vowels) From this point 
on anagramming of the key word presents no problem 
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k. The student should go over carefully the principle of "conversion 
into monoalphabet ic terms" explained in subpar. f above until he thoroughly 
understands it. Later on he will encounter cases in which this principle 
is of very great assistance in the cryptanalysis of more complex problems. 
(Other examples will be found in pars. 36 » 61, and 62.) 

l. The principle illustrated in subpar. e, above, that is, shifting 
two or more monoalphabetic frequency distributions relatively so as to 
bring them into proper alignment for amalgamation into a single monoalpha- 
betic distribution, is called matching . It is a very important cryptanalytic 
principle. Note that its practical application consists in sliding one 
monoalphabetic distribution against the other so as to obtain the best 
coincidence between the entire sequence of crests and troughs of the other 
distribution. When the best point of coincidence has been found, the two 
sequences may be amalgamated and theoretically the single resultant distri- 
bution will also be monoalphabetic in character. The successful applica- 
tion of the principle of matching depends upon several factors. First, the 
cryptographic situation must be such that matching is a correct crypto- 
graphic step. For example, the distributions in Fig. 23a are properly sub- 
ject to matching because the cipher component in the basic sequences con- 
cerned in this problem is the normal sequence, while the plain component is 

a mixed sequence. But it would be futile to try to match the distributions 
in subpar. 29 c, for in that case the cipher component is a mixed sequence, 
the plain component is the normal sequence. Hence, no ammount of shifting 
or matching can bring the distributions of subpar. 29c into proper Buper- 
imposition for correct amalgamation. (If the occurrences in the various 
distributions in subpar. 29c had been distributed according to the sequence 
of letters in the mixed component, then matching would be possible; but in 
order to be able to distribute these occurrences according to the mixed 
component, the latter has to be known — and that is just what is unknown 
until the problem has been solved?) A second factor involved in successful 
matching is the number of elements in the two distributions forming the 
subject of the test. If both of them have very few tallies, there is 
hardly sufficient information to permit of ocular matching with any degree 
of assurance that the work is not in vain. If one of them has many tallies, 
the other only a few, the chances for success are better than before, be- 
cause the positions of the blanks in the two distributions can be used as a 
guide for their proper superimposition. Fortunately, there exist certain 
mathematical and statistical procedures which can be brought to bear upon 
the matter of cryptanalytic matching. One of these, involving the ^ (chi) 
test, will be discussed in par. 37. 

m. The normal conditions existing that permit the employment of direct 
symmetry of position in polyalphabetic ciphers are those cases already 
tested wherein the plain component is a known sequence. In such examples 
the sequence of the plain component is inscribed along the top of the 
sequence reconstruction matrix, and direct symmetry will manifest itself 
among the cipher components within the matrix. When the inverse conditions 
are present, i.e., those cases wherein the cipher component is a known 
sequence and the plain component unknown, the usual method of solution is. 
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of course, the matching of distributions and the conversion of the 
cryptogram to monoalphabetlc terms. However, when the number of ele- 
ments in the distribution is very small, this method is inapplicable, 
and the only feasible solution involves the assumption of probable words. 

If the usual type of matrix is made (with an A to Z sequence outside for 
the plain component) , only indirect symmetry of position will be mani- 
fested. But if an inverse matrix is made having the known cipher component 
on the outside, then direct symmetry will be evident among the various plain- 
component alphabets. We will now consider an example to illustrate this 
technique . 

(l) Let it be assumed that the enemy has been using for his low- 
echelon cryptosystems a small cipher disc in which the cipher component is 
a standard alphabet, the plain component a mixed sequence which is changed 
daily. The following is the beginning of an intercepted message, the re- 
maining portion having been lost through operational difficulties: 

KOLNT EQZDF IXKTK XKYMB JJGBR HRTAF 

RWWVC FMKBY QBDT 

This message having originated from a headquarters that has frequently been 
guilty of stereotypic phraseology, it is suspected that the plain text be- 
gins with the opening phrase "REFERENCE YOUR MESSAGE NUMBER ..." Superim- 
posing the assumed plain text against the cipher text, 

5 10 15 20 25 

KOLNTEQZDFIXKTKXKYMBJ JGBRH 
REFERENCEYOURMESSAGENUMBER 

it is observed that Rp is enciphered as K^, at the first and thirteenth 
positions, thereby tentatively establishing the period-length as 12: 

KOLNTEQZDFIX 

REFERENCEYOU 

KTKXKYMBJJGB 

ffMESSAGENUMB 

RHRTAFRWWVCF 
E R 

MKBYQBDT. . . . 

The student will observe that all other periods from 2 to 14 are ruled out 
because of coincidences in the plain text which are not substantiated by 
like coincidences in the cipher for the assumed period-length. For example, 
the blocks for the periods 9 , 10, and 11 yield the following: 

( 9 ) ( 10 ) ( 11 ) 

REFERENCE REFERENCEY REFERENCEYO 

YOURMESSA OURMESSAGE URMESSAGENU 

GENUMBER HUMBER MBER 
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(2) An inverse matrix is made, and the plaintext values from the 
plain-cipher relationships above are inscribed within the matrix, as 
follows: 



Plain: 



1 . . 

2 . . 

3 • • 

h . . 

5 . . 

6 . . 

7 . . 

8 . E 



9 . . , E N 

10 Y . . . U 

11 M . 0 . 

12 . B 



Cipher : 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



After application of the principles of direct symmetry of position, the 
matrix will now look like this: 



Plain: 



Cipher: 



1 . S R A , . . C.EFG. . HHO . 

2 RA. . .C.EFG. . M N 0 • . S ■ 

3 . . .RA. . . C.EFG. .MNO. . S 

4 RA, . , C.EFG. .MHO. . S . . 

5 EFG. .MHO, . S . RA. . . C . 

6 .. C.EFG.. MHO.. S RA. 

7 . . .RA. . .C.EFG. .MHO. . S 

8 .EFG. .MHO. .S RA...C 

9 .C.EFG. .MHO. .S RA.. 

10 Y . . . U . . . B 

11 .EFG. .MHO. .S RA...C 

12 I* B Y . . . U . . 

ABCDEFGHIJKLMHOPQRSTUVWXYZ 



When these new derived values are substituted in the cryptogram, 

KOLNTEQZDFIX 

REFERENCEYOU 

KTKXKYMBJ JGB 
RMESSAGENUMB 

RHRTAFRWWVCF 
EROREFO R F 

MKBYQBDT 
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the Up of the segment ONE FOUR in the third line permits the amalgamation 
of the two partial sequences into one, viz. ; 



RAU. . CBEFG 



MNO..S Y. 



(3) With but little further experimentation, the entire plain text 
is synthesized and the plain component is found to be based on HYDRAULIC. 
The complete message fragment is now as follows: 

KOLNTEQZDFIX 

REFERENCEYOU 

KTKXKYMBJJGB 

RMESSAGENUMB 

RHRTAFRWWVCF 

ERONEFOUROFJ 

MKBYQBDT. . . . 

ULYTHIRD 

There is no evidence of a key word for the repeating key in the inverse 
matrix; but if the matrix is rewritten in the usual enciphering form, the 
key word HEADQUARTERS will be apparent under Hp. Thus: 



Plain: 



Cipher: 





H 


Y 


D 


R 


A 


U 


L 


I 


C 


B 


E 


F 


G 


J 


K 


M 


N 


0 


P 


Q 


S 


T 


V 


W 


X 


z 


1 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


2 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


u 


V 


w 


X 


Y 


z 


A 


B 


C 


D 


3 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


k 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


5 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


6 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


7 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


8 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


9 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


10 


E 


F 


G 


H 


I 


J 


K 


L 


M 


H 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 
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M 
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0 


P 


Q 


R 



37« The ~?C (chi) test for evaluating the relative matching of distri- 
butions. - -a. The student by now is well familiar with the 4> test which is 
used to determine the monoalphabetlcity of a single distribution. If two 
messages were enciphered monoalphabetically by the same cipher alphabet, 
it follows not only that their corresponding distributions would be mono- 
alphabetic, but also that these distributions would be strikingly similar 
in respect to their corresponding peaks and troughs. Likewise, if in a 
polyalphabe tic cipher there are repeated letters in the key, then the dis- 
tributions appertaining to the repeated letters will show identical spatial 
relationships of the positions of the peaks and troughs. Furthermore, in 
situations wherein the cipher component is a standard alphabet (or any other 
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known sequence) , these spatial relationships are relative and require only 
the correct juxtaposition of the distributions to make the relationships 
absolute. When the number of tallies in the distributions is large, ocular 
matching is a simple matter; however if the number of tallies is small, 
ocular matching becomes difficult and recourse must be had to statistical 
means for evaluating the relative matching of distributions. 

b. One of the simplest means for determining the relative matching 
or non-matching attributes of distributions is the X (chi) test, sometimes 
called the "cross-products sum.” With this test, which is related to the 
4> test 8 , the "observed value of X" is compared with the "expected value of 
X for matching distributions" (symbolized by X m) and the "expected value 
of X for non-matching distributions" (symbolized by X r ) . The formulas 
used for the expected values of X for matching and non-matching distribu- 
tions, respectively, are: 

X m « ,0667(N 1 H 2 ) and X r ■ .0385(N 1 H 2 ) 

where (N]N 2 ) represents the products of the total number of tallies in each 
distribution. The observed value of Xis calculated by multiplying the 
frequency of each element in the first distribution by its homologous 
counterpart in the second distribution, and totalling the result; i.e., the 
frequency of Ac in the first distribution is multiplied by the frequency 
of A c in the second distribution, etc., and then the sum of these cross 
products is obtained. 



c_. The use of the X test is best illustrated by an example. Suppose 
the following two distributions are to be matched: 

— S S _ — ~ — — S m m _ S a 

No. 1: ABCDEFGHIJKLMNOPQRSTUVWXYZ 



No. 2: ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Now let the frequencies be Juxtaposed, for convenience in finding the cross 
products, thus: 

f x 14030100100100100322101302 N x * 26 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 
f 2 02000300101001100311000012 N 2 «17 

fjf 2 . .. 08000300100000100922000004 Zfif 2 ■ 30 
X m « .0667(26x17) ■ 29.5; X r ■ .0385(26x17) - 17 

The fact that the observed value of X (30) agrees very closely with the 
expected value for matching distributions (29. 5) means that the two dis- 
tributions very probably belong together or are properly matched. Note 
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the qualifying phrase "very probably." It implies that there is no 
certainty about this business of matching distributions by mathematical 
methods; the mathematics serve only as measuring devices , so to speak, 
which can be employed to measure the degree of similarity that exists. 

There are other mathematical or statistical tests for matching, in 
addition to the "X test. 9 Moreover, it is possible to go further with the 
X test and find a measure of reliance that may be placed upon the value 
obtained; but these points will be left for discussion in the next text. 

d. One more point will, however, here be added in connection with 
the test. Suppose the very same two distributions in the preceding 
subparagraph are again juxtaposed, with f2 shifted one interval to the 
left of the position shown above, and let us take the cross-products 
sum. Thus : 

fl 14030100100100100322101302 M ■ 26 

ABCDEFGHIJKLMHOPQRSTUVWXYZ 

f 2 20003001010011003110000120 N ■ 17 

BCDEFGHIJKLMHOPQRSTUVWXYZA 

fif 2 ... 20000000000000000320000300 Zf X f 2 ■ 10 

Since the observed value of X (10) more closely approximates the expected 
value of X.for non -matching distributions (17) , it may be concluded that 
if the two distributions pertain to the seme primary components they are 
not properly superimposed. In other words, the X test may also be applied 
in cases where two or more frequency distributions must be shifted rela- 
tively in order to find their correct superlmpositlon. The theory under- 
lying this application of the Xtest is, of course, the same as before: 
two monoalphabetic distributions when properly combined will yield a single 
distribution which should still be monoalphabetic in character. In applying 
the Xtest in such cases it may be necessary to shift two 26-element dis- 
tributions to various superlmgoositions , make the Xtest for each superim- 
position, and take as correct that one which yields the best value for the 
test. The nature of the problem will, of course, determine whether the 
frequency distributions which are to be matched should be compared (l) by 
direct superimposition, that is, setting the A to Z tallies of one distri- 
bution directly opposite the corresponding tallies of the other distribution, 
as In aubpar. c; or (2) by shifted super imposition, that is, keeping the 
A to Z tallies~of the first distribution fixed and sliding the whole sequence 
of tallies of the second distribution to various super impositions against 
the first. 



e. A very common method of expressing the relative matching quality 

of a pair of distributions involves the ratio of the observed X to the 

*■0 .... 



expected value for X r . This ratio of 



Is called the "cross I.C. 

Xr 

(abbr. % I.C.). The cross I.C. is usually the preferred expression, rather 
than the X value, since the ratio gives a quick measure (when compared with 

9 The most important of these is die chi-square test based on the "X? distribution 
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the expected % I.C.'s of 1.73 and 1.00 for matching and nonmatching dis- 
tributions, respectively) of the relative goodness of a particular matching. 
For instance, in the example given in subpar. c, the £ I.C. of the tvo dis- 
tributions is 22. ■ 1>76 j in the example in subpar. d, the % l.C. is 10 ■ 

17 . “ !7 

0.59. The ordinary monographic l.C., i.e., *£, is often referred to as the 

9r 

& l.C. (read "delta l.C.”), in order to distinguish between this and the 
cross I.C. 



38. Modified Porta systems.- - a. Variations of the Porta system are 
possible, wherein either the A-M sequence is left undisturbed and the N-Z 
portion is mixed, or the A-M portion is mixed and the N-Z sequence is the 
normal; these situations are exemplified in Figs. 25a and b, below: 
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Figure 25a. Figure 25b. 

In such situations, one half of the cipher text may be converted into mono- 
alphabetic terms, while in the other half there will be manifested direct 
symmetry of position. 

b. Let the following cryptogram and its accompanying distributions be 
studied: 



W P A V V Q E 
C D L G F T H 
H N 0 0 Z E T 
H P K A F I J 
E M Y Y 0 Y J 
KIKCK IN 
JGQAL Q L 
E H D B X K E 
JHBGS K F 
S G P T V M N 
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X G J 

Y G K 
D J K 
LGE 
C E R 
P 0 Z 
Q A G 

Y T F 
AQZ 
C 0 u 



K R A S G 
E I D D J 
SMHGK 
EGQUL 
JFQBU 
K G W T Y 
G G L G F 
KULQL 
W S E C V 
SGQS J 



R D B S N 
RMQAJ 
E H A C X 
J I R V F 
K H D 0 I 
W D X E B 
SJVOL 
I J W D V 
HHQDF 
KIQHL 
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SIDIZ 
K U 0 T V 
I N D F R 
E X C U Z 
W E X V X 
K P F S 0 
JDBDE 
FTKPZ 
X B R V I 
G G V G H 



HPCTQ 
Z W R F F 
J E A G P 
F V R F Z 

Y N K A R 
G X B V L 

Y H Y G K 
T I W A Z 

Y J M D R 
H U Y I Z 



REF ID:A64563 



- -3-*- 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 



_ 2 S' = £ - ■ jt 2 _ _ s, * _ _ « 

(2) ABCDEFGHIJKLMNOPQRSTUVWXYZ 



ftBSjfe-- Sl_. ss jls sSSSfl 

(3) ABCDEFGHIJKLMNOPQRSTUVWXYZ 



(4) ABCDEFGHIJKLMNOPQRSTUVWXYZ 



- - ^ « 2 a 3 j& 0 - a 2 as j£ 2 _ jfe 

(5) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

It is noted that the A-M halves of the cipher distributions may be matched 
by sliding them at appropriate intervals; this is proof that a Porta matrix 
of the type shown in Fig. 25a has been used in the encipherment. The cor- 
rect matching is obvious: ~ 

_ isasisil _ 

(1) ABCDEFGHIJKLM 



_ - 

(2) MABCDEFGHIJKL 



(3) GHIJKLMABCDEF 

£=-$==$ - 

(4) JKLMABCDEFGHI 



- - $====$$ 

(5) BCDEFGHIJKLMA 
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c. The cipher letters A-M of the cryptogram may now be converted 
into monoalphabetic terms, using Alphabet 1 as a base, as shown in Fig. 2 6 
below: 
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Figure 


26 . 







The conversion process makes patent several new polygraphic repetitions 
which were previously latent in the cipher text. The threefold occurrence 
of the sequence F.KHC.H.F. at AS, ElU, and H13 can be established as proba- 
bly comprising a 10-letter repetition. The Xc at AS and E23 shows that 

and 0^° of the repetition are Identical plaintext letters, thus establish 

ing the partial idiomorphic pattern as ABCDC...AB which may be identified in 
a pa ttern list as bel ongin g to the plaintext word PHOTOGRAPH. At D3, the 
EEE C is most probably SSSp, with the preceding P c most likely an Ep. With 
these entries, reconstruction of the matrix and recovery of the rest of the 
plain text is an easy matter. 

39. Additional remarks.- - a. It might be well to bring in at this 
point several observations in connection with the solution of the systems 
discussed thus far in this text. These observations are treated as brief 
notes below. 
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b. When factoring does not indicate a period uniquely, write out 
the cipher text on the fewest number of widths that will accomodate the 
possible periods. For instance if factoring indicates a maximum of 12 
alphabets, then writing the cipher text on the widths of 12, 10, and 8 
will facilitate examination and taking of distributions on the basis of 
2, 3, b, 5 , 6, 8, 10, and 12 alphabets. If only two periods are possible 
and one Is a multiple of the other, write out the text on the longer 
period; in other cases where there are only two possible periods, select 
the least common multiple for the first trial. 

c. When confronted by a polyalphabetic cipher of a fairly lengthy 
period, and the problem involves the matching of comparatively small dis- 
tributions , the % test should be used to match the distributions, begin- 
ning with a pair of distributions having the best "profiles ", and after 
all the distributions have been matched, the cipher text is converted to 
monoalphabetic terms. Even if some of the distributions are mismatched, 
it will usually be possible to solve the resulting monoalphabet; systema- 
tic garbles every nth position will point to the distributions incorrectly 
matched. However, - if the repeating key is a plaintext key, a search for 
plaintext fragments in one of the columns of the matched distributions 
might make possible a quick recovery of the repeating key and thereby by- 
pass difficulties in matching some of the "less good" distributions. 

d. If the repeating key of a polyalphabetic cipher is not found under 
the first letter of the plain component, and It is known or assumed that 
the normal equation 0^/2 ° ®i/l> ®p/l ■ ®c/2 is used-* then completing the 
plain-component sequence on the "key" under any 0p will disclose the key 
word if one was used. 

e. If in a polyalphabetic cryptogram there are two or more sets of 
long polygraphic repetitions of equal length, consider the possibility 
that these two sets might be different encipherments of the same plain 
text, and look for corr oborating evid ence. For example, if Set "A" was 
partially rec overed as 7 m. . . A. TE. Sp and Set "B" was recovered as 

.EA. ...R.ER.p, these values may be amalgamated into .EA. . .ARTERSp and 
further expanded into HEADQUARTERS. 

f . The student should keep his mind open to possible variations of 
a basic idea, even if a particular variation might seem at first blush 
to contradict a general principle. For instance, although in Porta en- 
cipherment it is not expected that a letter may be enciphered by itself, 
nevertheless in the matrix illustrated below such a contingency is possible. 



AB 

CD 



ABCDEFGHIKLM* 

NOPQRSTUVWXYZ 

OPQRSTUVWXYZN 

PQRSTUVWXYZNO 






YZNOPQRSTUVWX 
ZNO P Q R S T U V W X Y 
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The A-M component has been shortened by combining I and J, so by con- 
vention a letter appearing in the asterisked column may be represented 
by itself. 

g. Polyalphabetic numerical systems vith "standard" alphabets have 
been discussed in par. 25* When however the cipher component consists of 
a mixed numerical sequence , then direct symmetry of position will of course 
be manifested, and this fact can be exploited in the solution of a crypto- 
gram. If however the cipher component is a "normal” numerical sequence 
(say, a sequence of the dinames 01-26 or the dincmes 10-45 in numerical 
order) and the plain component is an unknown mixed sequence; then the 
methods discussed in par. 36 are applicable. 



TJ O NT I D Eft T IAL 



103 




REF ID:A64563 



CONFIDENTIA IT 

CHAPTER VI 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, II; 
INDIRECT SYMMETRY OF POSITION 
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Reconstruction of primary components by employing principles of indirect symmetry of position . 45 

Theory of a graphical method of indirect symmetry 46 

Further remarks 47 



jjO. Further eases to be considered, -- a. Thus far Cases II a and b 
of the mixed-alphabet eases mentioned in par. 8 have been treated. There 
remains Case II c which has been further subdivided as follows : 

Case II c. Both components are mixed sequences. 

1. Components are identical mixed sequences. 

(a) Sequences proceed in the same direction. (The secondary 
alphabets are mixed alphabets.) 

(b) Sequences proceed in opposite directions. (The secondary 
alphabets are reciprocal mixed alphabets.) 

2. Components are different mixed sequences. (The secondary 
alphabets are mixed alphabets.) 

b. The first of the foregoing subcases, i.e. , Case II cl (a), will 
now be examined. Case II cl (b) will be taken up in subparT Mm, and Case 
II c 2 vill be treated in sub par . hho. ~ 

hi. Identical primary mixed components proceeding in the same direc- 
tion.— a. It is often the case that the mixed components are derived from 
an easily remembered word or phrase, so that they can be reproduced at any 
time from memory. Thus, for example, given the key word QUESTIONABLY, the 
following mixed sequence is derived: 

QUESTIONABLYCDFGHJKMPRVtfXZ 

b. By using this sequence as both plain and cipher component, that is, 
by sliding this sequence againBt itself, a series of 26 secondary mixed 
alphabets may be produced. In enciphering a message, sliding strips may be 
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employed with a key word to designate the particular and successive positions 
in which the strips are to be set, the same as was the case in previous 
examples of the use of sliding components. The method of designating the 
positions, however, requires a word or two of comment at this point. In 
the examples thus far shown, the key letter, as located on the cipher com- 
ponent, was always set opposite A, as located on the plain component; pos- 
sibly an erroneous impression has been created, viz . , that this is invari- 
ably the rule. This is decidedly not true, as has already been explained 
in par. 13c. If it has seemed to be the case that 0^ always equals Ap, it 
is only because the text has dealt thus far principally with cases in which 
the plain component is the normal sequence and its initial -letter, which 
usually constitutes the index for Juxtaposing cipher components, is A. It 
must be emphasized, however, that various conventions may be adopted in this 
respect; but the most common of them is to employ the initial letter of the 
plain component as the index letter. That is, the index letter, 61, will be 
the initial letter of the mixed sequence, in this case, Q. Furthermore, to 
prevent the possibility of ambiguity it will be stated again that the pair 
of enciphering equations employed in the ensuing discussion will be the 
first of the 12 set forth under par. 13f, viz*, 0k/2 ■ ®i/l» ®p/l ■ ®c/2* 

In this case the subscript "1" means the plain component, the subscript 
"2", the cipher component , so that the enciphering equation is the following: 
®k/c ■ ®i/ P 5 ®p/p ■ e c/c- 

c. By setting the two sliding components against each other in the 
two positions shown below, the cipher alphabets labeled (l) and (2) given 
by two key letters, A and B, are seen to be different. 

Key letter » A 

Plain component .... QUESTIOHABLYCDFGHJKMPHVWXZ 

Cipher component... QUISTIOHABLYCTFGHJKMPRVWXZQUESTIOIIABLYCDFGHJKMPRVWXZ 

®k 

Secondary alphabet (l): 

Plain ABCDEFGHIJKLMHOPQRSTUVWXYZ 

Cipher HJPRLVWXDZQKUGFEASYCBTIOMN 

Key letter * B 04 

* 

Plain component.... QUESTIOHABLYCDFGHJKMPRVWXZ 

Cipher component... QUESTIOKABLYCDFGHJKMPRVWXZQUESTIQHABLYCDFGHJKMPRVWXZ 

t 

®k 



wmxiamtL 



106 



REF ID:A64563 



CONFIDEN T IAL 



Secondary alphabet (2): 



Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 



d. Very frequently a square table is employed by the correspondents, 
instead of sliding strips, but the results are the same. Ihe cipher square 
based upon the word QUESTIONABLY is shown in Fig. 27. It vill be noted 
that it does nothing more than set forth the successive positions of the 
two primary sliding components; the top line of the square is the plain 
component, the successive horizontal lines below it, the cipher component 
in its various juxtapositions. The usual method of employing such a square 
(i.e., corresponding to the enciphering equations 6^ • Oj/pj 9p/ p • 0 C / C ) 
is to take as the cipher equivalent of a plaintext letter tnat letter which 
lies at the intersection of the vertical column headed by the plaintext 
letter and the horizontal row begun by the key letter. For example, the 
cipher equivalent of EL with key letter T is the letter 0 C ; or Ep (T k ) • 

0 C . The method given in subpar. b , fen* determining the cipher equivalents 
by means of the two sliding strips yields the same results as does the 
cipher square. 

1 2 3 4 5 « 7 8 0 10 11 12 13 H 15 16 17 18 10 30 21 22 23 24 25 28 

QUESTIONABLYCDFGHJKMPRVWXZ 
UESTIONABLYCDFGHJKMPRVWXZQ 
ESTIONABLYCDFGHJKMPRVWXZQU 
STIONABLYCDFGHJKMPRVWXZQUE 
TIONABLYCDFGHJKMPRVWXZQUES 
IONABLYCDFGHJKMPRVWXZQUEST 
ONABLYCDFGHJKMPRVWXZQUESTI 
NABLYCDFGHJKMPRVWXZQUESTIO 
ABLYCDFGHJKMPRVWXZQUESTION 
BLYCDFGHJKMPRVWXZQUESTIONA 
LYCDFGHJKMPRVWXZQUESTIONAB 
YCDFGHJKMPRVWXZQUESTIONABL 
CDFGHJKMPRVWXZQUESTIONABLY 
DFGHJKMPRVWXZQUESTIONABLYC 
FGHJKMPRVWXZQUESTIONABLYCD 
GHJKMPRVWXZQUESTIONABLYCDF 
HJKMPRVWXZQUESTIONABLYCDFG 
JKMPRVWXZQUESTIONABLYCDFGH 
KMPRVWXZQUESTIONABLYCDFGHJ 
MPRVWXZQUESTIONABLYCDFGHJK 
PRVWXZQUESTI ONABLYCDFGHJKM 
RVWXZQUESTIONABLYCDFGHJKMP 
VWXZQUESTIONABLYCDFGHJKMPR 
WXZQUESTIONABLYCDFGHJKMPRV 
XZQUESTIONABLYCDFGHJKMPRVff 
ZQUESTIONABLYCDFGHJKMPRVWX 

Figure 27. 
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42. Enciphering and deciphering by identical primary mixed components 



There is nothing of special interest to he noted in connection vith the 



use either of identical mixed components or of an equivalent square table 
such as that shown in Fig. 27, in enciphering or deciphering a message. 

The basic principles are the same as in the case of the sliding of one 
mixed component against the normal, the displacements of the two components 
being controlled by changeable key words of varying lengths. The components 
may be changed at will and so on. All this has been discussed adequately 
enough in Chapter II. 



43. Principles of solution.- - a. Basically the principles of solution 
in the case of a cryptogram enciphered by tvo identical mixed sliding compo- 
nents are the same as in the preceding case. Primary recourse is had to 
the principles of frequency and repetition of single letters, digraphs, tri- 
graphs, and longer polygraphs. Once an entering wedge has been forced into 
the problem, the subsequent steps may consist merely in continuing along the 
same lines as before, building up the solution bit by bit. 



b. Doubtless the question has already arisen in the student's mind as 
to whether any principles of symmetry of position can be used to assist in 
the solution and in the reconstruction of the cipher alphabets in cases of 
the kind under consideration. This phase of the subject will be taken up 
in the succeeding paragraphs and will be treated in a detailed manner, be- 
cause the theory and principles Involved are of very wide application in 
cryptanalytics . 

44. Theory of Indirect symmetry of position in secondary alphabets. — a. 
Note the tvo secondary alphabets (1) and (2) given in subpar. 4lc. External- 
ly they show no resemblance or symmetry despite the fact that they were pro- 
duced from the same primary components. Nevertheless, when the matter is 
studied vith care, a symmetry of position is discoverable. Because it is a 
hidden or latent phenomenon, it may be termed latent syaaetry of position . 
However, the phenomenon has a long-standing designation in cryptologic liter- 
ature as an indirect symmetry of position and this terminology has grown into 
usage, so that a change now is perhaps inadvisable. Indirect symmetry of 
position is a very interesting and exceedingly useful phenomenon in crypt- 
analytics . 

b. Consider the following secondary alphabet (the one labeled ( 2 ) in 
subpar . 4lc): 

f Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ 

{ Cipher: JKRVYWXZFQUMEHGSBTCDLIONPA 



c. Assuming it to be known that this is a secondary alphabet produced 
by two identical mixed primary components, it is desired to reconstruct the 
latter. Construct a chain of alternating plaintext and ciphertext equiva- 
lents, beginning at any point and continuing until the chain has been com- 
pleted. Thus, for example, beginning with Ap « J c , J p * Q c , % ■ B c , . . ., 
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and dropping out the letters common to successive pairs, there results 
the sequence A J Q B , . . . By completing the chain the following se- 
quence of letters is established: 



AJ QBKULMEYPSCRTDVIFWOGXHHZ 



d. This sequence consists of 26 letters. When slid against itself 
it will produce exactly the same secondary alphabets as do the primary 
components based upon the word QUESTIONABLY. To demonstrate that this is 
the case, compare the secondary alphabets given by the two settings of the 
externally different components shown below: 

Plain component .... QUESTIONABLYCDFGHJKHPRVWXZ 

Cipher component . . . QUESTIONABLYOTFGHJKMPRVWXZ^UESTIOKABLYCTFGHJKMPRVWXZ 

Secondary alphabet (l): 



Plain. ... ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Cipher. .. JKRVYWXZFQUMEHGSBTCDLIONPA 

Plain component.... AJQHKUU4EYPSCRTDVXFWOGXIIHZ 

Cipher component... AJQHCUIJWE^fPSCRTDVlTtfOGXKHZAJQBKUUiEIPSCRTIJVIFWOGXNHZ 
Secondary alphabet (2): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. .. JKRVYWXZFQUMEHGSBTCDLIONPA 



e. Since the sequence A J Q B K . . . gives exactly the same equiva- 
lents”^ the secondary alphabets as does the sequence QUEST. . . XZ, 
the former sequence is cryptographically equivalent to the latter sequence. 

For this reason the A J Q B K . . . sequence is termed an equivalent pri- 
mary component . 1 If the real or original primary component is a keyword- 
mixed sequence, it is hidden or latent within the equivalent primary sequence, 
but it can be made patent by decimation of the equivalent primary component. 
The procedure is aB follows: Find three letters in the equivalent primary 

component such as are likely to have formed an unbroken sequence in the 
original primary component, and see if the interval between the first and 
second is the same as that between the second and third. Such a case is 
presented by the letters W, X, and Z in the equivalent primary component 
above. Note the sequence . . .WOGXNHZ. . . , the distance or 
Interval between the letters W, X, and Z is three letters. Continuing the 
chain by adding letters three intervals removed, the latent original pri- 
mary component is made patent. Thus: 

1 2 S 4 5 8 7 8 # 10 11 12 13 14 IB IB 17 18 19 20 21 22 23 24 25 26 

WXZQUESTIONABLYCDFGHJKMPRV 



1 Such an equivalent component is merely a sequence which has been or can be derived from die original 
sequence or basic primary component by applying a decimation process to the latter, conversely, the original 
or basic component can be derived from an equivalent component by applying the same sort of process to the 
equivalent component By decimation is meant the selection of elements from a sequence according to some 
fixed interval For example, the sequence A E I M is derived, by decimation from the normal alpha- 
bet bv selecting every fourth letter 
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f . It is possible to perform the steps given in c and e in a com- 
bined single operation vhen the original primary component is a keyword- 
mixed sequence. Starting with any pair of letters (in the cipher com- 
ponent of the secondary alphabet) likely to be sequent in the keyword- 
mixed sequence, such as JKc in the secondary alphabet labeled (2), the 
following chain of digraphs may be set up. Thus, J and K in the plain 
component stand over Q and U, respectively, in the cipher component; Q 
and U in the plain component stand over B and L, respectively, in the 
cipher component, and so on* Connecting the pairs in a series, the fol- 
lowing results are obtained: 

JK— *-QU— ►BL-*-KM-*-UE-*-LY-*-MP-** ES-*- YC-*- PR— *- ST-*-CD-*-RV-+- 
TI-*-DF— *-VW— *-I0~*- FG-*-WX-*- ON— ►GH— ►XZ-+-NA-*- HJ-*- ZQ-*-AB— JK . . . 
These may now be united by means of their common letters: 

JK-»-KM-*-MP-*-PR-»-HV-^ etc. ■JKMPRVWXZQUESTIONABLYCDFGH 
The original primary component is thus completely reconstructed. 

&. Not all of the 26 secondary alphabets of the series yielded by 
two sliding primary components may be used to develop a complete equiva- 
lent primary component. If examination be made, it will be found that only 
12 of these secondary alphabets will yield complete equivalent primary com- 
ponents vhen the method of reconstruction shown in subpar. £ above is fol- 
lowed. For example, the following secondary alphabet, which is also derived 
from the primary components based upon the word QUESTIONABLY, will not yield 
a complete chain of 26 plaintext -ciphertext equivalents: 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. .. CDHJOKMPBRVFWYLXTZNAIQUEGS 

Equivalent primary components: 

l i i < i i ) i i io u n u I i a i 

ACHPXEOLFKVQT|ACH. . . (The A C H sequence begins 

again.) 

h. It is seen that only 13 letters of the chain have been established 
before the sequence begins to repeat itself. It is evident that exactly 
one -half of the chain has been established. The other half may be estab- 
lished by beginning vith a letter not in the first half. Rius: 

11««SS7B9 10UUU|123 

BDJRZSNYGMWUIjBDJ . . . (Hie B D J sequence begins 

again. ) 

1. There are several methods for combining two 13-letter chains. The 
simplest method, applicable vhen the primary component is a keyword-mixed 
sequence, will now be described. If we assume two letters to be sequent in 
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the original keyword -nixed sequence, such as for example J and K, and 
if these letters are not in the same 13 -letter chain, we would then 
write the two 13 -letter chains over one another, with the J of the one 
chain superimposed over the K in the other chain. Thus, using for an 
example the chains ACHPXEOLFKVQT and BDJRZSNYGMWUI 
established in subpars. £ and h above, we would have the following: 



B D J 
L F K 



R 

V 



ZSHYGMWUI 

QTACHPXEO 



The vertical digraphs thus formed are not incompatible with the mani- 
festations to be expected if the primary component were a keyword-mixed 
sequence. Bov noting the vertical digraph W, we may assume that Y will 

X 

follow it in the mixed component; the Y is not in the same 13 -letter chain 
that contains the X, so this looks promising. The chain containing the Y 
is now written beneath the diagram, properly juxtaposed so that Y is under 
the X, thus: 



BDJRZSNYGM 

LFKVQTACHP 

WUIBDJRZSN 



W 

X 

Y 



U I 
E 0 
G M 



The resulting vertical trigraphs are not satisfactory as portions of a 
keyword -mixed sequence, so it appears that Y must be in the key vord and 
not in the remaining semi -alphabetical portion of the sequence. If ve 
now assume that WX is followed by Z (which is not in the same chain as 
X) in the sequence, we have the following: 



BDJRZSNYGM 

LFKVQTACHP 

YGMWUIBDJR 



W| 

X 

z 



U I 
E 0 
S N 



The "good" trigraphs produced (DPG, JKM, etc.) attest to the correctness 
of the trial. We now have in effect a series of three-letter chains, 
which may be interconnected by the coannon letters in the first and third 
rows, thus: WXZ, ZQU, UES,...; this quickly yields the QUESTIONABLY. . . XZ 

sequence. Bote that these three-letter chains will always be at a constant 
interval apart; in this case, the interval was +7* 

JU The reason why a complete chain of 26 letters cannot be constructed 
from the secondary alphabet given under subpar. £ is that it represents a 
case in which two primary components of 26 letters were slid an even number 
of intervals apart. (This will be explained in further detail in subpar. £ 
below.) There are 12 such cases in all, none of which will admit of the 
construction of a complete chain of 26 letters. In addition, there is one 
case wherein, despite the fact that the primary components are an odd num- 
ber of intervals apart, the secondary alphabet cannot be made to yield a 
c ompl ete chain of 26 letters for an equivalent primary component. This is 
the case in which the displacement is 13 Intervals. Note the secondary 
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alphabet based upon the primary components below (which are the same as 
those shown in subpar. d): 

Primary Components 

QUESTIOMABLYCDFGHJKMPRVWXZ 

DFGHJKMPRVWXZQUESTIOHABLYC 

Secondary alphabet 

Plain. ... ABCDEFGHIJKLMNOPQRS TUVtfXYZ 
Cipher. . . RVZQGUESKTIWOPMHDAHJFBLYXC 

k. If an attempt is made to construct a chain of letters from this 
secondary alphabet alone, no progress can be made because the alphabet is 
completely reciprocal. However, the cryptanalyst need not at all be baffled 
by this case. The attack will follow along the lines shown below in sub- 
pars. 1 and m. 



1. If the original primary component is a keyword-mixed sequence, the 
cryptanalyst may reconstruct it by attempting to "dovetail" the 13 recipro- 
cal pairs (AR, BV, CZ, DQ, EG, FU, HS, IK, JT, LW, MO, HP, and XY) into one 
sequence. The members of these pairs are all 13 intervals apart. Thus: 



0 
A 
B 
C 
D 
E 
F 
H 

1 
J 
L 
M 
N 
X 



1 394(678910 11 1313 

• R 

• ••••«•••••• V 

• • • • »>»••• Z 

Q 

• »•••■«•*••■ 6 

• ••• • m • m • • U 

• •*••••••••• K 

• T 

• ••••••••••a W 

• •••> • • • • ■ 0 

• ••••• m m m m P 

• • • ■ • • * Y 



Write out the series of numbers from 1 to 26 and insert as many pairs 
into position as possible, being guided by considerations of probable 
partial sequences in the keyword -mixed sequence. Thus: 



01 11 4 8 0 7 8 010 1X 1111 14 1010 

ABCD R V Z Q 



It begins to look as though the key word commences with the letter Q, in 
which case it should be followed by U. This means that the next pair to 
be inserted is FU. Thus: 

0 1 2 0 4 4 0 T 8 010 111113 14 1416 17 

ABCDF RVZQU 
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The sequence A B C D F means that E is in the key. Perhaps the sequence 
is A B C D F G H. Upon trial, using the pairs EG and HS, the following 
placements are obtained: 

0 1 2 1 4 I « 7 a * 10 11 11 IS 14 14 14 17 IB 1 * 

ABCDFGH RVZQUES 

This suggests the vord QUEST or QUESTION. The pair JT is added: 

o i a a a a a t a auunuMuieiTiaiaa 
ABCDFGHJ RVZQUEST 

The sequence G H J suggests G H J K, which places an I after T. Enough 
of the process has been shown to make the steps clear. 

m. Another method of circumventing the difficulties introduced by 
the l5th secondary alphabet (displacement interval, 13) is to use it in 
conjunction with another secondary alphabet which is produced by an even- 
interval displacement. For example, suppose the following two secondary 
alphabets are available. 2 

$ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 RVZQGUESKTIWOPMNDAHJFBLYXC 

2 XZESKTIORNAQBWVLHYMPJCDFUG 

3he first of these secondaries is the 13-interval secondary; the second 
is one of the even-interval secondaries, from which only half-chain se- 
quences can be constructed. But if the construction be based upon the two 
sequences, 1 and 2 in the foregoing diagram, the following is obtained: 

RXUTNLDHMVZEIAYFJPWQSOBCGK 

This is a complete equivalent primary component. The original keyword- 
mixed component can be recovered from it by decimation at an interval of 
+ 9* 



RVWXZQUESTIONABLYCDFGHJKMP 

n. (l) When the primary components are identical mixed sequences 
proceeding in opposite directions, all the secondary alphabets will be 
reciprocal alphabets. Reconstruction of the primary component can be 
accomplished by the procedure indicated under subpar. m above. Note the 



2 The method of writing down die secondary alphabets shown in the diagram below will hereafter be 
followed in all cases when alphabet reconstruction matrices are necessary The top line will be under- 
stood to be the plain component, it is common to all the secondary alphabets, and is set off from the cipher 
components by the heavy black line This top line of letters will be designated by the digit 0, and will be 
referred to as "the zero line ' in the diagram The successive lines of letters, which occupy the space be- 
low die zero line and which contain the various cipher components of the several secondary alphabets, will 
be numbered serially These numbers may then be used as reference numbers for designating the horizontal 
lines m the diagram The numbers standing above the letters may be used as reference numbers for the 
vertical columns in the diagram Hence, any letter in the reconstruction matrix may be designated by 
coordinates, giving the row coordinate first Thus D (2-11) means the letter D standing in row 2, column 11 

U3 
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following three reciprocal secondary alphabets: 

1 2 3 4 3 8 7 8 9 10 11 12 13 14 IS 18 17 18 1# SO 21 22 23 24 25 28 

0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 



1 PMHGQFDCWYLKBRVAENZXUOITJS 

2.. .. WVMKSJHGQFDRCXZYILEUTBANPO 

3.. TSSZLXWVNRPEMIOKCJBAYHGFUD 

(2) Using lines 1 and 2. the following chain can be constructed 
(equivalent primary component; : 

PWQSOBCGKRXUTNLDHMVZEIAYFJ 

Or, using lines 2 and 3: 

WTYKZODPUAGVSLJXICMQNFREBH 

The original keyword -mixed primary component (based on the word QUESTION- 
ABLY) can be recovered from either of the two foregoing equivalent primary 
components. But if lines 1 and 3 are used, only half-chains can be con- 
structed: 



PTFXAKECVOHQL and MSDWNJUYRIGZB 

This is because 1 and 3 are both odd -interval secondary alphabets, whereas 
2 is an even -interval secondary. It may be added that odd -interval second- 
aries are characterized by having two cases in which a plaintext letter is 
enciphered by itself; that is, 0p is identical with 0 C . This phrase "iden- 
tical with" will be represented by the symbol = ; the phrase "not Identical 
with” will be represented by the symbol ^ . (Note that in secondary alpha- 
bet number 1 above, Fp ~ F c and Up =U C ; in secondary alphabet number 3 
above, Hpsl^. and Op^O c ). This characteristic will enable the cryptan- 
alyst to select at once the proper two secondaries to work with in case 
several are available; one should show two cues where 6p s= 8 C ; the other 
should show none. 

o. (l) When the primary components are different mixed sequences, 
their reconstruction from secondary cipher alphabets follows along the same 
lines as set forth above, under b to inclusive, with the exception that 
the selection of letters for building up the chain of equivalents for the 
primary cipher component is restricted to those below the zero line in the 
reconstruction matrix. Having reconstructed the primary cipher component, 
the plain component can readily be reconstructed. This will become clear if 
the student will study the following example: 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 



1 TVABULIQXYCWSNDPFEZGRHJKMO 

2 ZJSTVIQRMONKXEAGBWPLHYCDFU 
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(2) Using only lines 1 and 2, the following chain is constructed: 

TZPGLIQRHYOUVJCNEWKDASXMFB 

This is an equivalent primary cipher component. By finding the value of 
the successive letters of this chain in terms of the plain component of 
secondary alphabet number 1 (the zero line), the following is obtained: 

ASPTFGHUVJZEBWKNRLXOCMIYQD 

TZPGLIQRHYOUVJCNEWKDASXMFB 

The sequence ASPT. . . is an equivalent primary plain component. The 
original keyword -mixed components may be recovered from each of the equiv- 
alent primary components. That for the primary plain component is based 
upon the key PUBLISHERS MAGAZINE; that for the primary cipher component is 
based upon the key QUESTIONABLY. 

(3) Another method of accomplishing the process indicated above can 
be illustrated graphically by the following two chains, based upon the two 
secondary alphabets set forth in subpar. o (l): 

1 9 8 4 • 8 7 8 9 )0 U 13 13 14 IS 16 17 18 IV 30 21 22 23 24 3S X 

0. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



1 

2 



TVABULIQXYCWSNDPFEZGRHJ 



Z J S T V 


IQRMONKXEAGB 


JPLHYC 


Col 1 




Col 3. 






A (0-1) 


— > 


T (1-1), -* 


T (2—4:) -> 


D(0-4), -* 


D (0-4) 




B(l-4), -> 


B (2-17) -» 


Q (0-17), 


Q (0-17) 




F (1-17), -» 


F (2-25) -> 


Y (0-25), -* 


Y (0-25) 




M (1-25), -» 


M (2-9) -* 


I (0-9), -> 


I (0-9) 




X (1-9), 


X (2-13) -» 


M (0-13) , -» 


U (0-13) 




S (1-13), - 


S (2-5) -> 


C (0-3), - 


etc. 




etc 







K U 
D F 



0 

U 



(If) By Joining the letters in Column 1, the following chain is ob- 
tained: A D Q Y I M, etc. If this be examined, it will be found to be an 
equivalent primary of the sequence based upon PUBLISHERS MAGAZINE. By 
Joining the letters in Column 2, the following chain is obtained: T B F M X S, 
This is an equivalent primary of the sequence based upon QUESTIONABLY. 

£. A final word concerning the reconstruction of primary components 
in general may be added. It has been seen that in the case of a 26-element 
component sliding against itself (both components proceeding in the same 
direction) , it is only the secondary alphabets resulting from odd-interval 
displacements of the primary components vhich permit of reconstructing a single 
26 -letter chain of equivalents. This is true except for the 13th interval 
displacement, which, in spite of its being an odd number, still acts like 
an even -number displacement in that no complete chain of equivalents can be 
established from the secondary alphabet. This exception gives the clue to 
the basic reason for this phenomenon: it is that the number 26 has two 

factors, 2 and 13, which enter into the picture. With the exception of 
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displacement -interval 1, any displacement interval which is a sub -multiple 
of, or has a factor in common vith, the number of letters in the primary 
sequence will yield a secondary alphabet from which no complete chain of 
26 equivalents can be derived for the construction of a complete equivalent 
primary component . This general rule is applicable only to components which 
progress in the same direction; if they progress in opposite directions, 
all the secondary alphabets are reciprocal alphabets and they behave 
exactly like the reciprocal secondaries resulting from the 13 -interval dis- 
placement of two 26 -letter identical components progressing in the same 
direction. 

g. The foregoing remarks give rise to the following observations 
based upon the general rule pointed out above. Whether or not a complete 
equivalent primary component is derivable by decimation from an original 
primary component (and if not, the lengths and numbers of chains of let- 
ters, or incomplete components, that can be constructed in attempts to de- 
rive such equivalent components) will depend upon the number of letters in 
the original primary component and the specific decimation interval selected. 
For example, in a 26-letter original primary component, decimation interval 

5 will yield a complete equivalent primary component of 26 letters, whereas 
decimation intervals 4 or 8 will yield 2 chains of 13 letters each. In a 
24-letter component, decimation interval 5 will also yield a complete equiva- 
lent primary component (of 24 letters) , but decimation interval 4 will yield 

6 chains of 4 letters each, and decimation interval 8 will yield 3 chains 
of 8 letters each. It also follows that in the case of an original primary 
component in which the total number of characters is a prime number, w.n 
decimation intervals will yield complete equivalent primary components. 

The following table has been drawn up in the light of these observations, 
for original primary sequences from 16 to 32 elements. (All prime -number 
sequences have been omitted.) In this table, the column at the extreme 
left gives the various decimation intervals, omitting in each case the first 
interval, which merely gives the original primary sequence, and the last 
interval, which merely gives the original sequence reversed. The top line 
of the table gives the various lengths of original primary sequences from 
32 down to lb. (The student should bear in mind that sequences containing 
characters in addition to the letters of the alphabet may be encountered; 

he can add to this table when he is interested in sequences of more than 
32 characters.) The numbers within the table then show, for each combina- 
tion of decimation interval and length of, original sequence, the lengths 
of the chains of characters that can be constructed. (The student may note 
the symmetry in each column.) The bottom line shews the total number of 
complete equivalent primary components which can be derived for each dif- 
ferent length of original component. 
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Decimation Number of characters in original primary component 



interval 


32 


_30_ 


28 


_2L 


26 


25 


24 


22 


21 


20 


18 


16 


2 


w 


15 


"T T 


27 


13 


25 


12 


11 


21 


10 


9 




3 


32 


10 


28 


9 


26 


25 


8 


22 


7 


20 


6 


16 


4 


8 


15 


7 


27 


13 


25 


6 


11 


21 


5 


9 


4 


5 


32 


6 


28 


27 


26 


5 


24 


22 


21 


4 


18 


16 


6 


16 


5 


14 


9 


13 


25 


4 


11 


7 


10 


3 


8 


7 


32 


30 


4 


27 


26 


25 


24 


22 


3 


20 


18 


16 


8 


4 


15 


7 


27 


13 


25 


6 


11 


21 


5 


9 


2 


9 


32 


10 


28 


9 


26 


25 


8 


22 


7 


20 


2 


16 


10 


16 


3 


14 


27 


13 


5 


12 


11 


21 


2 


9 


8 


11 


32 


30 


28 


27 


26 


25 


24 


2 


21 


20 


18 


16 


12 


8 


5 


7 


9 


13 


25 


2 


11 


7 


5 


3 


4 


13 


32 


30 


28 


27 


2 


25 


24 


22 


21 


20 


18 


16 


14 


16 


15 


2 


27 


13 


25 


12 


11 


3 


10 


9 


8 


15 


32 


2 


28 


9 


26 


5 


8 


22 


7 


4 


6 




16 


2 


15 


7 


27 


13 


25 


6 


11 


21 


5 


9 




17 


32 


30 


28 


27 


26 


25 


24 


22 


21 


20 






18 


16 


5 


14 


9 


13 


25 


4 


11 


7 


10 






19 


32 


30 


28 


27 


26 


25 


24 


22 


21 








20 


8 


3 


7 


27 


13 


5 


6 


11 










21 


32 


10 


4 


9 


26 


25 


8 












22 


16 


15 


14 


27 


13 


25 


12 












23 


32 


30 


28 


27 


26 


25 














24 


4 


5 


7 


9 


13 
















25 


32 


6 


28 


27 


















26 


16 


15 


14 




















27 


32 


10 






















28 


8 


15 






















29 


32 
























30 


16 
























Total number 


14 


6 


10 


16 


10 


18 


16 


8 


10 


6 


4 


6 



of complete 
sequences 



45. Reconstruction of primary components by employing principles of 
indirect synaaetry of position.- - -a. Let us now consider the application 
of indirect symmetry in a typical example. In a certain periodic poly- 
alphabetic cryptogram under study which factored to five alphabets , the 
following assumptions based on repetitions in the cipher text have been 
made: 



1234^123 


34512345 


123451234 


512345 


ZF00WATF 


XSMAQUHX 


YINOBRKXF 


IPZZPO 


DIVISION 


REGIMENT 


ARTILLERY 


ATTACK 


T'i INl'TTIMTT 
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These values are Inserted in a sequence reconstruction matrix, as illus- 
trated below: ' 



0 ABCDEFGHIJKLMKOPQRSTUVWXYZ 



1 


T 


Z 


A 


R 


P 


2 




K 


F 


Q T 


I Z 


3 


Z 


U 




F 


X N 0 


4 




P S 


0 


H 


F 


5 


I 


H 




0 B 


tf X 



Figure 28. 

It is clear from the intervals (X...0), (S...0), and (M. ..0) in rows 3, 4, 
and 5 that the plain component is not the normal sequence. If an inverse 
matrix were constructed, it would disclose that neither is the cipher com- 
ponent the normal sequence, if this possibility had not already been ruled 
out by the absence of matching qualities of the distributions for the five 
alphabets. It is also evident that this is not a case of mixed sequences 
proceeding in opposite directions, since reciprocity between the plain and 
cipher is contradicted (e.g., in Alphabet 1, Ap ■ Y c , but Ac ■ Ip). At the 
moment, we do not know whether the plain component is identical with the 
cipher component, or whether it is a different mixed sequence, -in the ab- 
sence of evidence to the contrary 3 , we will assume the former hypothesis . 

b. In order to derive additional values for possible insertion in the 
cryptogram, around which values further assumptions may be made sued thus 
speed up the process of solution, certain relationships among the letters 
in the matrix may be studied. For convenience, we may refer to these rela- 
tionships as "proportions", arising from the process of "proportioning." 
Proportioning should be done in a systematic manner, if it is to be effi- 
cient; this is especially true in the Initial stages of solution, when it 
is important not to overlook a possible derived value. The following pro- 
cedure is suggested to insure thoroughness of method. 

(l) Each vertical pairing in the matrix is transferred to the horizon- 
tal, and a four-element proportion is utilized to complete another propor- 
tion which has three elements in common with the first proportion. Refer- 
ring to Fig. 28, we shall start with the vertical pairing AX (0-1, l-l) and 
transfer whatever data is available to the horizontal pairing AX (0-1, 0-25) 
The vertical pairing AX includes proportionally, between rows 0 and 1, the 
pairs DZ, IA, LR, and TP; or, expressed differently, A:X::D:Z::I:A::L:R::T:P 
The horizontal pairing AX (0-1, 0-25) includes no other proportional pairs— 
however there are present the latent proportions A:X::X:6, A:Y::Z:0, 
A:Y::0:F, and A:Y:tI:9. Now as we have already established the four -element 



3 4n hypothesis of identical components proceeding in the same direction would be ruled out by a situ- 
ation in which, for example, m one of the alphabets Ap = A C} and m the same alphabet Bp * B c , or this 
hypothesis would be ruled out if in one alphabet there were evidences of only partial reciprocity (such as 
= i»c » Ac = tp , Np = Rq , but Nq ^ Rp). 
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proportion A:Y::I:A from the vertical pairing, then we know that the 6 
in the last horizontal proportion A:Y::1:6 must be the letter A; there- 
fore we place A in the matrix at position 5-25- 

(2) This process of transferring values is then attempted for the 
vertical pairing AZ (0-1, 3-1), and then for AK, but with negative results. 
When the vertical pairing AX is considered, the proportion A:I::Y:A turns 
up once again, but this yields no additional information since this pro- 
portion has already been established when we placed the A at 5-25. The 
subsequent vertical pairings CP, BZ, EK, EU, ES, and GM yield nothing 
further until IA is reached, wherein IA (0-9, 1-9) * AY (0-1, l-l). But 

it is noted that the homologous proportion IA (0-9, 0-l) ■ AY (1-9, l-l) 
has its elements in exactly the same locations as IA (0-9, 0-1) “ AY (0-1, 
l-l), so no transference of data from one alphabet to another is possible. 
In other words, the data within a proportion of four elements in one par- 
ticular "rectangular" reading may be transferred to a different rectangu- 
lar reading having three of the elements in common. The need, of course, 
for seeking a four - element proportion first is that proportions in eryptan- 
alyticB must be defined by four elements (for a given set of enciphering 
components) , because unlike the field of mathematics wherein the missing 
member of 2:4::3:x must be a 6, the cryptanalytic proportion A:B::C:6 could 
be satisfied by any letter, depending upon the components involved. What 
we were actually saying by the proportion A:Y::I:A is that in a certain 
pair of components (the case under study) we have established an empirical 
cryptanalytic proportion, and that this relationship will be true in all 
cases Involving these same four elements. 

(3) The vertical pairing IA nevertheless yields a good proportion, 
namely IA (0-9, 1-9) * DZ (0-4, 1-4), which permits the insertion of the 
letter D in position 3-9 after the homologous rectangular reading IA 
(0-9, 0-1) * OZ (3-9, 3-1) • Then the vertical pairing IF will yield the 
value T at the position 4-6 from the proportion I:F::0:T. This process 
is continued until the last vertical pairings at the extreme right of the 
matrix have been treated. 

£. The matrix will now appear as in Fig. 29, below, after we have 
systematically proportioned once straight across the matrix from left to 
right : 



0 ABCDEFGHI JKLMHOPQBSTUVWXYZ 



1 


Y L 


Z I 


A 


FRG 


K 


0 P 


S 


T 




2 




K 


F 


P E Q 


T 


I X Z 


H 


D 




3 


Z 


U 


T D 




F 


X N 


0 






4 


K 


P ST 


0 




H 








F 


5 


I 


U KM 


E 


0 B 


S T 


L W X 






A D 



Figure 29. 
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It should be emphasized, that this has been a rather theoretical treat- 
ment of the problem in order to demonstrate the principles of proportion- 
ing. In actual practice, of course, the derivation of additional values 
would be a basis upon which to make further plaintext assumptions, prob- 
ably rendering unnecessary the rigorous systematization of the process of 
proportioning across the width of the matrix, as just described. 

d. From the matrix in Fig. 29, the following partial chains, frag- 
ments~~of equivalent primary components, are derived: 

0-1 E I A Y DZ WSOKF LR MG XTP 

0-2LEKP RIF MQ OTZ SXD VH 

0-3 A_Z EU HTNF I_D RX VO 

0-4 A K CP ES YFT 10 NH 

0- 5YAIE ZDU FKOSW GM RLB TX 

1- 2 A F P Z IKTD RE OX 

It is observed that the chains 0-3 and 1-2 bear a 1:3 relationship, i.e., 
one is an expansion at an Interval of 3 of the other (cf. AZ and ID in 
line 0-3, and AFPZ and IKTD in line 1-2). Let then the chains in 1-2 be 
considered as a relative + 1 decimation of the primary sequence, and in- 
scribe AFPZ in the first four positions of a line of 26 cells on cross- 
section paper, thus: 

1 2 3 4 5 6 7 8 9 10 11 12 13 M 16 IS 17 18 19 20 21 22 23 24 25 26 

AFPZ 

Now since the chains in line 0-3 cure a 1:3 contraction of the chains in 
line 1-2, then in order to equate line 0-3 with line 1-2 we must expand 
or decimate the former at an interval of 3. That is, the interval between 
the letters AZ must be 3 instead of 1. This expansion, of course also 
applies to the remaining chains in line 0-3. Thus HTNF must be expanded 
into H. .T. .N. .F; and since we already have an F in our basic AFPZ sequence, 
these letters are then interpolated as follows: 

1 2 a 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 

AFPZ H T N 

e. With these new values, the sequence IKTD from the assumed +1 
decimation in line 1-2 may be added, because of the presence of T in 
both sequences, 

1 2 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 28 24 25 26 

AFPZ HIKTDN 

and the remaining fragments in the various chains may be amalgamated to 
permit the completion of the sequence as follows: 

1 2 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

AFPZLJSYCMVREOXUGQHIKTDBNW 
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This complete equivalent primary component , reconstructed from a series 
of smaller chains derived from a number of other equivalent primary com- 
ponents, may now be decimated to produce the original primary component 
which is a keyword -mixed sequence. 

f . It must be noted that proportioning does not yield any new basic 
data, “but merely gives a re -statement of data already latent or inherent 
in the matrix; what the process does is to make all the relationships 
patent and this re-statement facilitates the derivation of chains. Fur- 
thermore, in the sets of partial chains given in subpar. d, the first 
five chains (0-1, to 0-5) give all the latent relationships present in the 
matrix. However, the addition of one more set of chains (line 1-2) brings 
out the existing relationships in a much clearer light than would have 
otherwise been possible, and this materially speeds up solution. 

g. Another example may be presented to demonstrate further the 
principles of indirect symmetry. In a polyalphabetic cryptogram which 
factored to six alphabets, the following message beginning is assumed, 
based on collateral information: 



123456 123456 123456 123456 123456 1 
EKIIBK KGOZVZ DIWBBH LFCRKZ WKODBB Q. . . 

ONEFIV EFIVEM MHOWIT ZERAMM UNITIO N 

The values from this crib are put into a sequence reconstruction matrix, 
as follows: 



0 ABCDEFGHIJKLMHOPQBSTUVWXYZ 



1 




K 




DQE 


W L 


2 




F G 


I 


K 




3 




I 


0 


W 


C 


4 


R 


I 






D ZB 


5 




V 


B 


K 




6 








Z B 


H K 



Noting an apparent +1 decimation of a keyword-mixed primary component 
between lines 0-2, EF:FG::HI, we may begin to reconstruct the original 
primary component by inspection directly without deriving additional 
values by proportions: 4 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 28 24 25 26 



(0-2) EF:FG: :HI E F G H I 

(0-3) EI:I0:CW EFGHI...0...W 

(0-4) FI: :WB E F G H I . . . 0 . . . W . . B 

(3-5) IV: :0B EFGHI. . , 0. . VH. . B 

(0-1) 0E::UW EFGHI. ..0..VW..B....U 



Continuing in this vein, the original primary component may be quickly re- 
covered; let the student finish the solution as an exercise. 



4 it must be pointed out that there is no proof at this stage that the HI ties in with EFG, the HI might 
be in die key word, but there is a greater probability that it is a part of the remaining alphabetical 
sequence after the occurrence of the key word. 
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46. Theory of a graphical method of indirect symmetry. 5 — a. It 
has been shown that the interval between letters of a sequence obtained 
from a secondary alphabet is a constant function of the interval sepa- 
rating the letters in the original primary component. Consider the 
following sequence: 

QUESTIONABLYCDFGHJKMPRVWXZ 



Assume that this component is slid against itself and that the following 
groups of partial sequences are obtained from three secondary alphabets: 

Group 1--S T I; U E; N A 
Group 2—1 N; E Tj 0 A 
Group 3— T N; Q S 0 

Figure 30. 

Referring to the primary component, it will be seen that the letters of 
the partial sequences obtained from group 1 coincide in their interval 
(i.e., a +1 decimation) with that in the primary component; the letters 
of the partial sequences obtained from group 2 represent a decimation 
interval of two in the primary component; and those obtained from group 
3, a decimation interval of three. 



b. In the foregoing case, decimation was accomplished by taking 
intervals to the right along a horizontal component. Referring to the 
square based on QUESTIONABLY given in Fig. 27 on p. 107, let a portion 
of that square or matrix be considered, as shown in Fig. 31 below: 



1 


2 


3 


4 


5 


6 


7 


8 


Q 


U 


E 


S 


T 


I 


0 


N 


u 


E 


S 


T 


I 


0 


N 


A 


E 


S 


T 


I 


0 


N 


A 


B 



STIONABL 

(a) 

Column No. 12345678 
[jpUESfrJlON 

U — E— Js] T 1—0—® A 

E S T— I— {0] NAB 



STIONABL 



1 2 
Q U 

U E 

E S 

S T 



1 2 
U 

U ,E 

I 

E 
S T 





S 

T 

I 



3 

E 

S 

T 

I 



4 5 6 7 8 

5 T gm N 

0 i 0 EP0 

1 0 N A B 
0 N A 3 L 



(b) 

4 5 6 7 



S 

T 

I 

0 



[tj i 0 

ION 
0-® A 



A B 



8 

N 

A 

B 

L 



T I 0 N A B 
(c) 



L Y T I-® 
Figure 31 • 



NAB 

(a) 



L 



Y 



5 The basic theory underlying this modified method of applying the principles was first set forth in a 
brief paper m November 1941 by 1st Lt. Paul E Neff, Sig. C. His original notes, slightly modified, com- 
prise pars. 46 and 52, and subpars. 53a to d_, inclusive. 
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c. Again referring to Fig. 30, the partied sequences STI, UE, and 
HA can be obtained from Fig. 31a by reading down columns k, 2, and 8, 
respectively. TOiis can be represented graphically by the symbol \l, 
which means that all partial sequences obtained from Fig. 31a by pro* 
ceedlng downward in any column would be in the same group (i.e. , second- 
ary alphabet) and have the same decimation interval. 

d. The partial sequences IN, ET, and OA can be represented graphi- 
cally - ' by ll , or simply \l, which indicates that all partial sequences 

obtained by talcing letters one space down and one space to the right, or 
one space down a diagonal to the right would represent the same decimation 
interval. 

e. The partial sequences TH and Q@0 can be represented by the symbol 
1U ;*"but they can also be represented by 2l and, if the entire matrix 

2 1 
of Fig. 27 i8 considered, by other possible routes. 

f. The decimation interval of a secondary sequence derived from a 
primary is the sum of the horizontal and vertical components of the route 
selected . Since the partial sequence TH can be represented by 1| ^ , the 

decimation interval of this sequence is equal to the vertical decimation 
Interval of the basic square plus twice the horizontal decimation Interval 
in that square. Any other route selected for the Bame sequence would give 
an equivalent of this. 

g. It is seen, therefore, that the decimation interval of a com- 
ponent can be represented graphically in various ways other than along the 
horizontal, by use of diagrams such as in Fig. 31, in which the successive 
Juxtaposed components have the same relative displacement. In this case 
the successive horizontal lines had a one -letter displacement to the left. 

h. Not being limited to one dimension, reconstruction of the primary 
component or an equivalent should be possible in one combined matrix by 
reversing the foregoing process and graphically Integrating partial se- 
quences from different secondary alphabets into a single diagram. Suppose 
the partial sequences in Fig. 30 are given and it is desired to reconstruct 
the primary component. 



Group — — — — 

Partial sequences— 



STI 


I N 


U £ 


E T 


N A 


0 A 




1 


J 1 

Figure 32 
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i. (l) Using cross-section paper one can arbitrarily select tbe STI 
sequence in group 1 and write this sequence horizontally, making the 
graphical notation below group 1. 

1 

(2) Proceeding to group 2, the partial sequence Hi contains one let- 
ter in common with the sequence STI already entered, but since HA forms 

a sequence in group 1 and OA forms a sequence in group 2, it is clear 
that two different decimations are involved and therefore it would be in- 
correct to integrate the STI and the IN into STIN However, the letter 
N can arbitrarily be placed in any position other than along the horizon- 
tal line on which STI has been placed. It will be placed directly below 
the letter I and the group will be denoted graphically by jl, giving: 

STI 
. . N 

Figure 33a. 

(3) The skeleton of the matrix or diagram is now fixed in two dimen- 
sions, and no further letters can be arbitrarily placed within it. How- 
ever , additional sequences from groups 1 and 2 can be added, provided a 
common letter is available in the diagram; sequences from other groups 
can be added, provided one pair is already entered in the diagram which 
would fix the proper graphical decimation. 

(4) Moving to group 3 , there is the partial sequence TN and it is 
noted that this pair of letters is present in the diagram. The symbol ^ 1 
can therefore be placed under group 3» 



(5) In group 3 the partial sequence Q30 appears and the letter S is 
in the diagram. It therefore follows that the letters Q and 0 can be 
placed thus: 



(1) Q . . . 

(2) .STI 

(3) ..ON 

Figure 33b. 

(6) Similarly the letter £ of the partial sequence ET in group 2 
goes directly above the T: 



(1) Q . E . 

(2) .STI 

(3) 



. 0 N 
Figure 33c. 

(7) The letter U of the sequence UE in group 1 goes before the E: 



(1) QUE. 

(2) .STI 

(3) ..OH 

Figure 33d. 
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(8) Likewise the letter A of HA in group 1 follows N: 

(1) Q U E . . 

(2) . S T I . 

(3) . . 0 N A 

Figure 33e* 

(9) The sequence OA in group 2 remains to be entered. Since both 
these letters are already in the diagram, the letter A can be placed under 
the existing 0 or the letter 0 can be placed above the existing A. Either 
alternative would be correct. Selecting the latter alternative yields the 
following: 

(1) QUE. . 

(2) . S T I 0 

(3) . . 0 N A 

Figure 33f. 

All the original information has now been entered in the diagram 
seen in Fig. 33f end the letter 0 appears twice therein. This letter 0 
may be termed the "tie-in" letter since it indicates the horizontal inter- 
val between the juxtaposed reconstructed sequences of the basic matrix. 

The absence of a tie-in letter in the diagram would indicate that insuf- 
ficient data are present for the reconstruction of a complete sequence. 

k. (l) By sliding the last row of Fig. 33f two intervals to the right 
the two O's can be superimposed, giving: 

(1) QUE.... 

(2) . S T I 0 . . 

(3) .... 0 » A 

Figure 33$. 

(2) Since each horizontal sequence must be shifted two intervals to 
the right of its initial position in relation to the line above, row (l) 
must be moved two intervals to the left of its original position. Thus: 

(1) QUE 

(2) . . . S T I 0 . . 

(3) 0 N A 

Figure 33h. 

(3) Since the three rows Involve the same decimation, and since the 
0 of ONA coincides with the 0 of STIO, the OKA sequence may be raised up 
one row and united with the STIO sequence. If this is legitimate then the 
new row (2) may likewise be raised up one row. This yields the united 
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sequence QUESTIONA. . . . This last step may be more clearly understood 
by studying the following partially reconstructed matrix: 



(1) 


[F 


U 


El 


\s_ 


T 


I 


0 


N . . 


(2) 


E 


s 


T 


1 


0 


N 


A 


B . . 


(3) 


T 


II 


si 


H 


A 


B 


L 


Y . . 


(4) 


0 


N 


A 


B 


L 


Y 


C 


D . . 






Figure 33i. 





1. The application of this graphical method of indirect symmetry 
to a specific example will be illustrated in par. 52, in the next chapter. 

47. Further remarks . — a . A study of the principles and techniques 
discussed in this chapter should impress the student with the importance 
and value of Indirect symmetry of position as a tool in cryptanalytics . 
Admittedly, indirect symmetry is a difficult subject to treat in writing, 
as it lends itself much better to blackboard demonstration in a classroom 
to insure thorough understanding of the principles. In any case, it is 
only by practice on a multitude of different examples and cases that these 
principles can be firmly implanted in the mind of the student — and even 
then the practice must be a continuous process, as it is only too easy 
to lose adroitness and facility in the application of these principles. 

b. It is recommended that the student prepare as training aids five 
strips' bearing the following sequences, double length: 

(1) A normal A-Z sequence. 

(2) A keyword-mixed sequence based on QUESTIONABLY. 

(3) A keyword-mixed sequence based on QUESTIONABLY. 

(4) A QUESTIONABLY keyword-mixed sequence, running in reverse. 

(5) A keyword -mixed sequence based on HYDRAULIC. 

With these strips the phenomena arising in all cases of direct and indirect 
symmetry may be duplicated, and the strips will be found useful in further 
experimentation and study. For example, strips (l) and (2) may be used to 
produce the phenomena of direct symmetry; (2) and (3) may oe employed to 
produce the manifestations inherent in indirect symmetry extending to the 
0 (plaintext) alphabet; (3) and (4) will bring out the peculiarities in- 
herent in cases of indirect symmetry within the matrix only, but with the 
added feature of reciprocity between the plain and cipher components; and 
(4) and (5) will duplicate the idlosyncrades of indirect symmetry within 
the matrix only. 

c. The student has seen the two principal methods of the application 

of indirect symmetry, and perhaps the question will be asked: "Which 

method is preferable?" The answer is— both are useful. In most cases it 
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is usually easier to employ the graphical method, but occasionally there 
is encountered a problem vhich is easier to solve by the linear method. 6 
But both methods should be practiced constantly, in order to maintain 
facility in the application of these principles. 

d. Thus far there has been treated the recovery of primary com- 
ponents based on keyword-mixed sequences only. What would happen if the 
primary component were, say, a transposition -mixed sequence? In the pre- 
vious text 7 it has been shown how to recover the key word in various types 
of sequences, Including transposition-mixed sequences. If, however, a 
transposition -mixed sequence were decimated, as it would be in the case of 
an equivalent primary component , a slight modification of procedure is 
necessary. 

(1) Let us consider the following sequence: 
AJVCODFSHBPIHZLMXRGTUKWYEQ 

?his can easily be reduced to its original transposition rectangle: 

493718652 

HYDRAULIC 

BEFGJKMMO 

PQSTVWXZ 

However, if the basic sequence were decimated at an interval of three, 

ACFBNMGKEJOSPZXTWQVDHILRUY 

the usual procedures of uncovering the transposition do not apply. The 
sequence must be decimated at the intervals of + 3> + 5, +7> + 9 > and +11; 
these resultant sequences are then examined in turn in an attempt to re- 
move the transposition, reading these sequences both forwards and back- 
wards. When the +9 decimation is considered, it will yield the original 
transposition. 

(2) In unusual circumstances wherein all the secondary alphabets 
consist of even decimations, thus giving rise exclusively to 13 -letter 
chains, there is an approach which may be used to cope with this dis- 
tressing situation. For Instance, let us suppose that we have the two 
chains (AEPTOQPCHYNMK) and (BZWXLUBVUSGF) . We will assume that the let- 
ters VWXYZ are at the end of the transposition matrix, and we will complete 



® As an example, it should be noted that the chains m subpar. 45d_ permit of easier treatment by the 
linear method than by the graphical method, let the student confirm this by experiment. 

7 Military Cryptanalytics, Part I , par. 51, 
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the sequences on these letters from the foregoing chains, thus: 

V W X Y Z 
U X L N W 
SLIHX 
G I J K L 
F J R A I 
BRVEJ 
ZVOPR 
W U S T V 
X S G 0 U 
L G F Q S 
I F B D G 
J B Z C F 
RZWHB 

The sequence GIJKL on the fourth line certainly looks like part of the 
transposition matrix two rows above the VWXYZ row. The diagram may now 
be expanded to the left and right, as is shown below: 

STUVWXYZ 
GOSUXLNW 
FQGSLIMX 
BDFGI JELMIOPQ 

fJraikmqtd 
BRVEJAKDOC 
ZVUPREACQH 
WUSTVPEHDY 
XSGOUTPYCN 
LGFQSOTNHM 
IFBDGQOMYK 
JBZCFDQKNA 
RZWHBCDAME 
HCEKP 
YHPAT 
E Y T E 0 

The key word PREACH (or PREACHER) is manifested, and, with a little 
experimentation, the original transposition matrix is recovered as fol- 
lows: 



14 3 12 k 
PREACH 
BDFG1J 
KLMNOQ 
STUVWX 
Y Z 

This example admittedly is a simple case because of the brevity and par- 
ticular composition of the key word; longer key words quickly complicate 
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the problem of recovery, but the general lines just indicated will apply. 
Each case must be treated as a special case; the cryptanalyst has to be on 
the alert to capitalize on any peculiarities or phenomena manifested. 

e. In treating a periodic cipher, the first step is, of course, to 
determine the number of alphabets involved by factoring the intervals 
between the various polygraphic repetitions. The cryptogram is then 
written out in proper period -lengths , and distributions for each alphabet 
are made; if necessary (that is, where the number of tallies per distri- 
bution is small), I.C.'s of the distributions are calculated, for futher 
proof of the correctness of the factoring. These distributions are now 
carefully examined for (l) a possible fitting of all the distributions to 
the normal frequency distribution or its reverse, which would show that 
standard alphabets are Involved; (2) a possible matching of all the dis- 
tributions in respect to each other, which would show that the cipher com- 
ponent is the normal sequence; (3) a possible direct matching, "head on", 
of two or more distributions, which would show that the repeating key has 
repeated letters in the homologous positions; and (h) a possible fitting of 
only one or so of the distributions to the normal, "head on." If case 

(k) is present, then it is proof that the cryptogram is either a normal 
Porta with that particular distribution being in the key (A,B) , or else 
the cryptogram involves Indirect symmetry extending to the 0 (plaintext) 
row of the reconstruction matrix, since this manifestation is brought about 
by the interaction of a mixed sequence against itself, running in the same 
direction, with the juxtaposition Ap ■ Ac, so that every letter in that 
particular alphabet would be enciphered by Itself. 

f. After the distributions have been examined, assumptions of high 

frequency letters or of probable words are inserted in the sequence recon- 
struction matrix, which in turn is examined for evidences or contradictions 
of direct symmetry or of indirect symmetry either within or without the 
matrix. (If reciprocity in more than one alphabet is observed, then it 
may be assumed that the cryptogram Involves a mixed sequence running 
against itself in reverse.®) Whenever an assumption of a plaintext value 
for a cipher letter is made, the student should be sure to finish four 
things before making any further assumptions: (l) the plaintext value 

should be entered below all occurrences of the cipher letters; (2) the 
value should be entered in the reconstruction matrix; (3) examination 
should be made if any inconsistencies are produced either in the plain 
text or in the matrix; and (4) an attempt should be made to derive new 
values by direct symmetry or by proportioning within the matrix. Adherence 
to the foregoing systematization of method will save much time, contribute 
to the proper cryptanalytic education of the student, and will prove of con- 
siderable Importance in the solution of difficult problems encountered in 
actual operations. 



8 Reciprocity in only one alphabet could be caused by a sequence shifted 13 posmons against itself, 
in the case of 26 -letter components. 



C O H i riM S BTIAL 



129 



REF ID:A64563 



rmun ir_ 
WI1X AMHIIajliui 



g. As a final remark on indirect symmetry, it must be noted that 
Porta matrices, as veil as Vigenere-type matrices, might be encountered 
in vhich indirect symmetry will be manifested; this situation will obtain 
vhen both "families" of the Porta matrix are mixed sequences. It also 
follows that Indirect symmetry will be present in schemes wherein the 
cipher component is a mixed numerical sequence and the plain component 
is also a mixed sequence. 
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46. Applying the principles to a specific example . — a . The proceeding 
chapter, with the many details covered, now forma a sufficient base for pro- 
ceeding with an exposition of how the principles of Indirect syaaoetry of 
position can be applied very early in the solution of a polyalphabetlc sub- 
stitution cipher in which sliding primary components were employed to pro- 
duce the secondary cipher alphabets for the enciphering of the cryptogram. 

b. The case described below will serve not only to explain the method 
of applying these principles but will at the same time show how their appli- 
cation greatly facilitates the solution of a single, rather difficult, poly- 
alphabetic substitution cipher. It is realized, of course, that the crypto- 
gram could be solved by the usual methods of frequency and long, patient 
experimentation. However, the method to be described was actually applied 
and very materially reduced the amount of time and labor that would other- 
wise have been required tor solution. 

49. The cryptogram employed in the exposition. —a. Hie problem that 
will be used in this exposition involves an actual cryptogram submitted for 
solution in connection with a cipher device having two concentric disks 
upon which the same random-mixed alphabet appears, both alphabets progressing 
in the same direction. This was obtained from a study of the descriptive 
circular accompanying the cryptogram. By the usual process of factoring, it 
was determined that the cryptogram involved 10 alphabets. !Zhe message as 
arranged according to its period is shown in Fig. 34, in which all repeti- 
tions of two or more letters are indicated. 

b. Hie triliteral frequency distributions are given in Fig. 35- It 
will be seen that on account of the brevity of the message, considering the 
number of alphabets involved, the frequency distributions do not yield many 
clues. By a very careful study of the repetitions, tentative individual 
determinations of values of cipher letters, as Illustrated in Figs. 36, 37, 
36, and 39, were made. These are given in sequence and in detail in order 
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to shew that there is nothing artificial or arbitrary in the preliminary 
stages of analysis here set forth. 

The Cryptogram 
(R epetitions underlined) 

123450789 10 12145(789 10 19845078910 

A W FJJ P_C F 0 C JY P RCV 0 P N BLCJ EE BKDZFMTGQJ 

B GBZDPPB OUO Q L Q Z A A A M_D C H FF LH^TZV H Q 

C GRFTZMQM A_V R BZZCKQOIKF GG ZGWNKXJTRN 

D K Z U G D YFTJRJL S _C F B S C V X_£ H 0 HH YTXCDPMVLW 

E _G J X N L W YOU X T _Z T Z S D M_X W C M II BGBWWOQRGN 

F I K W E P 0 ZOKZ U RKUHEQEDGX JJ HHVLAQQV A_V 

G P R XJ2 W L Z I C W _ V FKVHPJJK J_Y KK JQVOOTTNVQ 

H _G K Q H 0 L 0 D V M W Y Q D P C J X L L L LL BK X_D S 0 Z R S N 

I_GOXSNZHA S_E X GH X E R 0 Q P S_E 
J B B J I P_2 F J H D Y _ G K BffTLFDUZ 
K QCBZEXQT X_Z Z OCDHWMZTUZ 
L JCQRQFVMLH AA KLB P C J 0 T X E 
M S R Q E W M L N A E_ BB HSP 0 P N M D L M 

N G S X E R 0 Z J S E CC J C K W D V BL S E RR Y B ff E W V M D W J 

0J3VQWEJMKGH DD_GS U G D P O^T H X SS R Z X 
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BCD 


E F G H 


EB FF 


XK YB ES 


HZ FC 


OR NH 


XK 


WJ ZO 


WG 


WK 


QK 


uo 




ES 




EV 




LH 




EK 




HC 




ES 



Triliteral Frequency Distributions 
I 



ZC VZ WQ ZC ZR DC HC HR UK -F YQ QT 
VQ ZL JF UK NT QG 
QJ JZ MU 

HB 



n 




ABCDEFGHIJKLNNOPQRSTUVWXYZ 



GZ QB 


WU ZW GX 


GX IW KB 


GX 


LZ GF GX ZZ YX GQ 


KU 


BJ JQ 


CB BB HV 


JU GQ 


HZ 


YD PX HP YX 


BZ 


YW RV 


LU 


RU 




JV SQ GU 


RX 


OD 




FV 








GK 




GB 








CU 




BD 












BX 












UH 









III 



ABC 


D E 


F G H 


I J 


K L M 


NOP 


Q R S T V 


V 


W 


X Y Z 


CZ 


QP 


RT 


BI 


CW 


SO 


KH 


FP 


CO 


KE 


JN 


BD 


FS 


CH 










OR 


ZG 


KH 


GM 


RD 


QA 


KW 


KZ 










RE 


KH 


HL 


QO 


OS 


ZC 


LP 












VW 


SG 




KP 


SE 


TS 


GW 














FY 




BE 


HE 


00 
















JG 






TC 


















CG 






KD 
























UO 





IV 



A 


B 


C D E 


F 


G H I 


J 


K 


L 


U N 0 P 


_Q_ 


R S T 


U 


V 


W 


_X_ 


Y Z 


ZA 




ZK ZP WP 




UD QO JF 






VA 


XL VP UC 




QQ XN FZ 






QE 




UD BE 






XD XW QW 




UD UE 








WK PP DC 




BC 






BT 




DF 






XS XR 




UD VP 








WO BC 




ZD 






KD 










XR 




UD DW 








XP WE 










BW 










WW 












ZW 
































V 
















k_ 


_B_ 


C D E 


_F_ 


G H I 


J 


K 


L 


U M 0 P 


_Q_ 


R S T 


U 


V 


W 


_x_ 


Y Z 





AA 


PF GY ZX ZM 


CQ NW 


SZ HL DF RF EO DO WL 


DL 




LQ 


SV SU WJ 


NX 


OT EQ EO 


EM 






PJ WV HQ 




IQ 


HU 






PJ GP PF 




ON 


WO 


• 




YT 




HJ 


OU 


• 




GP 

CW 




ON 

OP 


EV 



GW 
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AM 


CO 


EM 


WZ ZQ PB RZ DO PZ DZ 


CX LY EQ DF NH 




PB 


PJ 


00 WL PM RQ DM PF OT 


DB DQ KJ 1 




QV 


CX 


TF DX 


WQ PY KO 


WM DP 




EX 


CO 


WZ 


SZ EE 










FT 


AQ 










WX 












VII 






A B 


C D E F G H 


I J K 


L H N 


0 P Q R S T U 


V W X Y Z 



FO 


QD YT 


ZA 


JK 


MN JK 


FC WE MM 


MG 


FM 


VC WO QO 


ML 


QJ 




XT 


AD 


LD 


XT 


TN 




MW PO LI 


VL 


LD 






ND 


QI 


OP 






JL OJ 










PV 


JT 


OR 






MC MT 










VD 


PT 


QV 






FE TV 














WR 






OR 










VIII 












B C 


D E F G 


H I 


J K 


L M N 


0 P 


Q R 


S T U 


V W 


X Y Z 



oj ov XN 

XH MC PU 
XG EG 
FU 
ML 
MY 



ZC FH UG BC QA LA BU QS 
OK ZS JJ XL VL TV YU 
BS ZK 

YX 



BCDEFGHIJKLMNOPQRSTUVWXYZ 



QG 


FR 


ZH XC 


ZS 


QX 


ML 


QV 


zu 


QA 




ox 






OH 






JR 




R S 


T U 


V W 



IW 




KH JD 


CY 


E3 


MH EF 


GJ TW AE 


00 DM 


TZ DJ 


LW 




DX CQ 


KY IF LL 


TN JE 


OX NQ 


TE 


DH 




RN TX 






DM 


PE 


DZ RM 


OZ 


WM 




CQ VQ 






VW 


LE 


TZ 
















RN 


EH 














X 








C 


D E F 


GHZ 


J 


_K_ 


L M N 0 


P Q R S T 


U V W 


Z Y Z 
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Initial Values From Assumptions 
12 3 s 

G C =E P , K 0 =E P , X 0 =Ep, and D„=Ep, from frequency considerations 

343 456 901 

UGD=THE, PCJ=THE, and SEG=THE, from study of repetitions 





l 


9 14 


A 6 7 8 9 10 




i 


9 


3 4 5 6 7 


8 


9 10 




1 2 


8 4 5 


8 


7 


8 9 10 


A 


W 


FUP 


C F 0 C J Y 


P 


R 


C 


V 0 P N B 


L 


c w 


EE 


B K 


D Z F 


M 


T 


G Q J 






T T 


H 
















E 










B 


G 


B Z D 


P F B 0 U 0 


Q 


L 


Q 


z A A A M. 


D 


C H 


FF 


L F U Y D 


T 


Z 


V n_a 




E 






















T E 








C 


G 

E 


R F T 


Z M 0 M A V 


R 


B 


z 


Z C K Q 0 


I 


K F 


GG 


Z G 


W N K 


X 


J 


T R N 


D 


J_1 

K 


Z U_G 


D Y F T R W 


S 


C 


F 


B S C V X_ 


C 


O 


HH 


Y T 


X C D 


2 


M 


V L W 






T H 


E 








H 










E E 








E 


G 


J X N 


L W YOU X 


T 


Z 


T 


ZSDMX 


W 


C M 


II 


B G 


B ff ff 


o_fl 


R G N 




E 


E 




1 






E 


















F 


I 


K W E 


PQZQKZ 


U 


R 


K 


U H E Q E 


D 


G X 


JJ 


H H 


V L A 


Q Q 


V A V 






E 








E 


T 


















G 


P 


R X D 


W L Z I C W 


V 


F 


K 


V H P J J 


K 


J Y 


KK 


J Q 


WOO 


T T 


N V Q 






E 








E 


E 


















H 


G_ 


KQH 


0 L 0 D V M 


w 


Y 


Q 


D P C J X 


L 


L L 


LL 


B K 


X D S 


0. 


_Z 


R S N 




E 


E 










THE 








E 


E 






T 


I 


G 


0 X S 


N Z H A S E 


X 


G 


H 


X E R 0 0. 


P 


S E 


MM 


I u 


x 0 P 


P 


Y 


2 x_z 




E 


E 


T H 




E 




E 




T H 














J 


B 


B J I 


PQFJHD 


Y 


G_ 


JK 


B W T L F 


D 


U Z 


NN 


H 0 


Z 0 W 


M X C G Q 












E 


E 




















K 


Q 


C B Z 


E X Q T_X Z 


Z 


0 


C 


D H W_M Z 


T 


U Z 


00 


J J 


U G D W 


Q R V M 


























THE 








L 


J 


CQR 


QFVMLH 


AA 


K 


L 


B P C J 0 


_T 


X E 


PP 


U K 


J P E 


F 


X E N F 
















THE 




~ H 




E 


T 








M 


S 


RQE 


W M L N A E 


BB 


H 


S 


P 0 P N M D 


L M 


QQ 


C C 


U G D W 


P 


E U H 








H 


















THE 








N 


G 


S X_E 


R 0 Z J S E 


CC 


G 


C 


KKDVB 


_L 


S E 


RR 


Y B 


W E W V 


M 


_D Y J 




E 


E 


T H 




E 




E 




T H 














0 


G 


VQWEJMKGH 


DD 


G 


_S 


U G D P 0 


_T 


H X 


SS 


R Z 


X 










E 




E 




E 




THE - 










E 









Figure 36. 
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Additional Values from Assumptions (I) 

2 

Refer to line DD in Figure 29 , S, assumed to be Np. 

« 

Refer to line M in figure 29, A. assumed to be ff p 

• 10 1 2 t 4 i 

Then in lines C-D, AVKZUGD is assumed to be WITH THE 
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Figure 37. 
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Additional Valdes feom Assumptions (II) 

Refer to Figure 30, line A, W F U P C F 0 C J Y, assume to be BUT THOUGH 

T T H 

8 4 5 0 

Refer to Figure 30, lines N and X, where repetition X E R 0 occurs, assume EACH 
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Figure 38. 
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Additional Values From Assumptions (III) 

4 s « 

OPN — assume ING from repetition and frequency 

90 1 

HQZ — assume ING from repetition and frequency 
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Figure 39. 
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c. From the initial and subsequent tentative identifications shovn 
in Figs. 36 , 37, 38, and 39, the values obtained were arranged in the form 
of the secondary alphabets in a reconstruction matrix, shown in Fig. 40. 
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Figure hO. 



50. Application of principles. --a. Throughout this paragraph refer- 
ence will be made to Fig. 40, above. Hereafter , in order to avoid all am- 
biguity and for ease in reference, the position of a letter in Fig. 40 will 
be indicated as stated in footnote 2, p. 113 . Thus, N(6-7) refers to the 
letter 5 in row 6 and in column 7 of Fig. 40. 

b. (l) Let us consider the following pairs of letters: 

E(0-5) J(6-5) 

G(0-7) N(6-7) v 

(We are able to use the row marked ”0" in Fig. 40 since this is a case of 
a mixed sequence sliding against Itself .) 

(2) The immediate results of this set of values will now be given. 
Having HOF as a sequence, with EJ as belonging to the same displacement 
interval, suppose HOF and EJ are placed into juxtaposition as portions of 
sliding components . Thus : 



Plain .... . . .HOF. . . 

Cipher ... ...EJ.... 



When Hp ■ Eq, then Op « Jc* 

(3) Refer now to alphabet 10, Fig. 40, where it is seen that Hp « Ec. 
The derived value . Op ■ Jc, can be inserted immediately in the same alpha- 
bet and substituted in the cryptogram. 
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(4) The student may possibly get a clearer Idea of the principles 
involved if he will regard the matter as though he vere dealing with 
arithmetical proportion. For instance, given any three terms in the 
proportion 2:8*4:16, the 4th term can easily be found. Furthermore, 
given the pair of values on the left-hand side of the equation, one may 
find numerous pairs of values which may be inserted in the right-hand 
side, or vice versa. For instance, 2:8*4:16 is the Bame as 2:8*5 :20, 
or 9:36*4:16, and so on. An illustration of each of these principles 
will now be given, reference being made to Fig. 40. As an example of 
the first principle, note that E(0-5) :H(0-8) ■ J(6-5) :0(6-8). How find 
E(l0-8) :H(0-8) • ?(10-15) :O(0-15) • It is clear that J may be inserted 
as the 3d term in this proportion, thus giving the important new value 
10 

Op * J c , which is exactly what was obtained directly above, by means of 
the partial sliding components. As an example of the second principle, 
note the following pairs: 

E(0-5) H(0-8) 

K(2-5) Z(2-8) 

D(5-5) C<5-8) 

J(6-5) 0(6-8) 

These additional pairs are also noted: 

K(l-20) Z(l-7) 

T(0-2O) 0(0-7) 

Therefore, E:H*K:Z*D:C*J:0*T:G, and T may be inserted in position (4-5)* 

£• (l) Again, GH belongs to the same set of displacement -interval 

values as do EJ and HOF. Hence, by superimposition: 

Plain HOF... 

Cipher ... . . . G N . . . . 

(2) Referring to alphabet 4, when Hp » Ge, then Op ■ H c . Therefore, 
the letter H can be inserted in position (4-15/ in Fig. 40, and the value 
4 

H c * Op can be substituted in the cryptogram. 

(3) Furthermore, note the corroboration found from this particular 
superimposition : 

H(0-8) G(0-7) 

0(6-8) H(6-7) 

This checks up the value in alphabet 6, Gp ■ H c . 
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4. (l) Again superimpose HOF and GN: 

...HOF... 

. . . i 6 H . . . 

(2) Note this corroboration: 

0(6-8) G(4-8) 

F(6-15) N(4-15) 

which has just been Inserted in Fig. 40, as stated above. 

e. (l) Again using HOF and EJ, but in different superimposition : 

. . .HOF. . 

..£J.... 

(2) Refer now to H(9-9) , J(9-8). Directly under these letters is 
found v(10«9), E(l0-8). Therefore, the V can be added immediately before 
HOF, making the sequence V H 0 F. 

f. (l) Nov take V H 0 F and juxtapose it with E J, thus: 

. . . V H 0 F . . . 

. . . B J . . . 

(2) Refer now to Fig. 40, and find the following: 

V(10-9) E(l0-8) 

H<9-9) J(9-8) 

0(4-9) G(4-8) 

1(0-9) H(0-8) 

(3) From the value 0 G it follows that G can be set next to J in 
E J. Thus: 

. . , V H 0 F . . . 

• • , E J G . . . 

(4) But G N already is known to belong to the same set of displace- 
ment -interval values as E J. Therefore, it is now possible to combine 

E J, J G, and G N into one sequence, E J G N, yielding: 

. . . V H 0 F . . . 

. * . E J G N . • . 
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(l) Refer now to Fig. 40. 




V (0—22) 


2(0-5) 


? (1-22) 


G(l-5) 


?(2-22) 


K(2-5) 


7 (3-22) 


X(3-5) 


7(5-22) 


D(5-5) 


?(6-22) 


J(6-5) 



(2) The only values which can be inserted are: 

0(1-22) G(l-5) 

H(6-22) J(6-5) 

(3) This means that Vp * 0 C in alphabet 1 and that V p « He in al- 
phabet 6. There is one 0 C in the frequency distribution for Alphabet 1, 
and no He in that for Alphabet 6. The frequency distribution is, there- 
fore, corroborative insofar as these values are concerned. 



h. (l) Further, taking iJGS and V H 0 F, superimpose them thus: 

. . , E J G N 1 . . 

. . . V H 0 F . . . 



(2) Refer now to Fig. 40. 

E(0-5) H(0-8) 

G(l-5) 7(1-8) 

(3) From the diagram of superimposition the value G(l-5) F(l-8) 
can be inserted, which gives Hp * F c in alphabet 1. 

i. (l) Again, V H 0 F and E J G N are Juxtaposed: 

. . . V H 0 F . . . 

. • . E J G N . . . 

(2) Refer to Fig. 40 and find the following: 

H(0-8) G(4-8) 

A(0-l) E(4-l) 

This means that it is possible to add A, thus: 

. . , A V H 0 F . . . 

. . . E J G N . . . 
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(3) In the set there are also: 

E(0-5) G(l-5) 

0(0-7) Z(l-7) 

Then in the superioposition 

• • . E J G S ■ • . 

...EJGN... 

it is possible to add Z under G, making the sequence E J G N Z. 

(4) Then taking 

. . , AVHOP. . , 

* • . E J G N Z . * ■ 

and referring to Fig. 2(0: 

H(0-8) N(0-l4) 

0 ( 6 - 8 ) ?(6-l4) 

It will be seen that 0 ■ Z from super imposition, and hence in alphabet 6 
Np ■ Z c , an important new value, but occurring only once in the cryptogram. 
Has an error been made? The work so far seems too corroborative in inter- 
locking details to think so. 

(l) The possibilities of the superimposition and sliding of the 
AVHOF and the EJGNZ sequences have by no means been exhausted as yet, but 
a little different trail this time may be advisable. 

E(0-5) T(0-2O) 

G(l-5) K(l-20) 

X(3-5) U(3-20) 



( 2 ) Then: 



E J G N Z 1 m • 

TeK*,e 



( 3 ) Now refer to the following: 



E(0-5) 

■ -no 



K(2-5) 

S(2-l4) 



whereupon the value S can be Inserted: 



. . T 



EJGNZ. . . 
K . . S . . . 
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k. (l) Consider all the values based upon the displacement inter- 
val corresponding to JG: 



J(6-5) G(l-5) — *■ J(9-8) G(4-8) 

N(6-7) 2(1-7) H(9-9) 0(4-9) 

S(9-20) p(4-20) 



S(2-l4) P(5-l4) 
Z(2-8) C(5-8) 

K(2-5) D(5-5) 



(2) Since J and G are sequent in the E J G N Z sequence, it can be 
said that all the letters of the foregoing pairs are also sequent. Hence 
Z C, S P, and K D are available as new data. These give E J G N Z C and 
T . K D . S P. 



(3) Nov consider: 



T(0-2O) P(4-20) 
A(0-l) E(4-l) 
H(0-8) G(4-8) 
1(0-9) 0(4-9) 



Nov in the T . K D . S P sequence the interval between T and P is 



1 2 3 4 5 6 

T P. 

therefore that 
thus: 



Hence, the interval between A and E is 
the sequences AT 10 F and E J G N Z C 



6 also. It follovB 
should be united. 



1 2 3 4 5 6 

. . . AVHOF. EJGNZC. . . 



(4) Corroboration is found in the interval between H and G, which 
is also 6. The letter I can be placed into position, from the relation 
1(0-9) 0(4-9), thus: 

. . . I. .AVHOF. EJGNZC. . . 



1. (l) From Fig. 40: 



as 



.. , Z(2-8) 

E(0-5) K(2-5) 

N(0-l4) S(2-l4) 
' (-21) F(2-2l) 



(2) Since in the I. .AVHOF. EJGNZC sequence the letters 
H and Z are separated by 8 intervals one can write : 



H 

E 

N 

U 



1 2 3 4 5 



6 7 8 

. . Z 
. . K 
. . S 
. . F 
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(3) Hence one can make the sequence 

1 2 3 4 5 6 7 8 

. . . I. . AVEOF. EJGHZC . .K. . . 

. . . I. . AVHOF. EJGNZCT. K D , S P . . . 

. .01. .AVHOF. EJGNZCT. KD.SP. . . 

12345678 ” 1 2 3 4 5 6 7 ? 

(l) Subsequent derivations can be indicated very briefly 

iu m 

x 2 S 4 8 8 7 8 9 10 11 12 13 14 16 18 17 18 IB 20 31 

From UI. .AVHOF. EJGNZCT. KD. 
one can write ...E....C... 

1 2 3 4 5 

and . . . D . 

l 

making the sequence 

1 3 8 4 6 8 7 8 9 10 11 12 13 14 16 18 17 18 19 20 21 22 23 34 26 28 

UI. .AVHOF. EJGNZCT. KD.SP. R. 

(2) Another derivation: 

U(3-20) T{0-2O) 

X(3-5) E(0-5) 

1 2 3 4 8 8 7 8 910 11 1213 14 16 16 17 18 19 20212223242628 

From UI. . AVHOF. EJGNZCT. KD. SP.R. 
one can write 

UI T... 

and .........E.........X..... 



22 23 24 28 28 

S P . . . 



. . . R . 

2 3 4 5 



Then 

and 

m. 

follows: 



making the sequence 

1 2 8 4 6 8 7 8 9 10 11 12 18 14 16 18 17 18 19 20 21 22 23 24 23 28 

UI. . AVHOF. EJGNZCT. KDXSP.R. 

(3) Another derivation: 

B(0- 5) 0(1-5) 

B(0-2) W(l-2) 

From . . . E J G . . . 

one can write . . . E . G . . . 

and then . . . B . W . . . 



There is only one place where B . W can fit, viz ., at the end: 

1 3 3 4 5 6 7 8 9 10 11 13 13 14 16 16 17 18 19 20 21 22 23 24 28 28 

UI. . AVHOF. EJGNZCT. KDXSPBRW 
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n. Only four letters remain to be placed into the sequence, viz . , 
L , M, Q, and Y. Their positions are easily found by application of the 
primary component to the message. The complete sequence is as follows: 

1 2 3 * S S 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 2S 28 

UIMYAVHOFLEJGNZCTQKDXSPBRW 



Having the primary component fully constructed, decipherment of the crypto* 
gram can be completed with speed and precision. The text is as follows: 

WFUPCFOCJY RCVOPNBLCW BKDZFMTGQJ 

BUTTHOUGHW POSINGTHES SELFWILLGO 

GBZDPFBOUO LQZAAAMDCH LFUYDTZVHQ 

ECANNOTASY OLARSYSTEM OUTBECOMIN 

GRFIZMQHAV BZZCKQOIKF ZGWNKXJTRN 

ETREVIEWWI SHALLTURN A GACOLDANDL 

KZUGDYFTRW CFBSCVXCHQ YTXCDPMVLW 

THTHEHINDS NUNCHANGIN IFELESSHAS 

GJXNLWYOUX ZTZSDMXWCM BGBWWOQRGN 

EYEOURPAST GFACEINPER SANDTHESOL 

ITWEPQZOKZ RKUHEQEDGX HHVLAQQVAV 

WECAHTOANE PETUITYTOT ARSYSTEMWI 

PRXCWLZICW FKVHPJJKJY JQWOOTTNVQ 

XTENTFORES HESUNEACHW LLCIRCLEUH 

GKQHOLODVM YQDPCJXLLL BKXDSOZRSN 

EEOURFUTUR ILLTHEHHAV SEENGHOSTL 

GOXSNZHASE GHXEROQPSE YUXOPPYOXZ 

EWECANWITH EREACHEDTH IKEIHSPACE 

BBJIPQFJHD GKBWTLFDUZ HOZOWMXCGQ 

SCIENTIFIC EENDOFITSE AWAITINGON 

QCBZEXQTXZ OCDHWMZTUZ JJUGJWQRVM 

CONFIDENCE VOLUTIONSE LYTHERESUR 

JCQRQFVMLM KLBPCJOTXE UKWPEFXENF 

LOOKFORWAR TINTHEUNCH RECTIONOFA 

SRQEWMLNAE HSPOPNMDLH CCUGDWPEUH 

DTOATIMEWH ANGINGSTAR NOTHERCOSH 

GSXEROZJSE GCKWDVBLSE YBWEWVMDYJ 

ENEACHOFTH EOFDEATHTH ICCATASTRO 

GY QWEJMKGH GSUGDPOTHX RZX 

EBODIESCOM ENTHESUNIT PHE 

Figure *1. 
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o. The primary component appears to he a random-mixed sequence, no 
key word for the repeating key is to be found, at least none reappears on 
experimentation with various hypotheses as to enciphering equations. 
Nevertheless, the random construction of the primary component did not 
complicate or retard the solution. 

£. Some analysts may prefer to work exclusively with the reconstruc- 
tion matrix, rather than with sliding strips. One method is as good as 
the other and personal preferences vlll dictate which will be used by the 
Individual student. If the reconstruction matrix is used, the original 
letters should be inserted in red pencil, so as to differentiate them from 
derived letters. 

51. General remarks on the foregoing solution. — a. It is to be stated 
that the sequence of steps described in the preceding paragraphs corresponds 
quite closely with that actually followed in solving the problem. It is 
also to be pointed out that this method can be used as a control in the 
early stages of analysis because it will allow the cryptanalyst to check 
assumptions for values. For example, the very first value derived in ap- 
plying the principles of indirect symmetry to the problem herein described 
was He • Ap in alphabet 1. As a matter of fact the writer had been inclined 
toward this value, from a study of the frequency and combinations which He 
showed; when the indirect -syimaetry method actually substantiated his tenta- 
tive hypothesis he immediately proceeded to substitute the value given. If 
he had assigned a different value to He, or if he had assumed a letter other 
than H c for Ap in that alphabet, the conclusion would immediately follow that 
either the assumed value for He was erroneous, or that one of the values 
which led to the derivation of He = A p by indirect synmetry was wrong. Thus, 
these principles aid not only in the systematic and nearly automatic deriva- 
tion of new values (with only occasional, or incidental references to the 
actual frequencies of letters), but they also assiBt very materially in 
serving as corroborative checks upon the validity of the assumptions already 
made. 



b. Furthermore, while the writer has set forth, in the reconstruction 
matrix in Fig. 40 , a set of 30 values apparently obtained before he began to 
reconstruct the primary component, this was done for purposes of clarity 
and brevity in exposition of the principles herein described. As a matter 
of fact, what he did was to watch very carefully, when inserting values in 
the reconstruction matrix to find the very first chance to employ the prin- 
ciples of Indirect synmetry; and Just as soon as a value could be derived, 
he substituted the value in the cryptographic text. This is good procedure 
for two reasons. Not only will it disclose impossible combinations but also 
it gives opportunity for making further assumptions for values by the addition 
of the derived values to those previously assumed. Thus, the processes of 
reconstructing the primary component and finding additional data for the re- 
construction proceed simultaneously in an ever -widening circle. 

c. It is worth noting that the careful analysis of only 30 cipher 
equivalents in the reconstruction matrix shown in Fig. 40 results in the 
derivation of the entire table of secondary alphabets, 676 values in all. 

And while the elucidation of the method seems long and tedious, in its actual 
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application the results are speedy, accurate, and gratifying in their 
corroborative effect upon the mental activity of the cryptanalyst. 

d. (l) The problem here used as an illustrative case is by no means 
one that most favorably presents the application and the value of the 
method, for it has been applied in other cases with much speedier success. 
For exa mple , suppose that in a cryptogram of 6 alphabets the equivalents 
of only THEp in all 6 alphabets are fairly certain. As in the previous 
case, it is supposed that the secondary alphabets are obtained by sliding 
a mixed alphabet against Itself. Suppose the secondary alphabets to be as 
follows : 



0 

1 

2 

3 

4 

5 

6 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



B Q E 

CL X 

IV C 

HP B 

X 0 P 

T Z V 



Figure 42. 



(2) Consider the following chain of derivatives arranged diagrammat- 
lcally: 



H(0-8) 0(5-8) 

T(0-2O) P(5-20) 

E(0-5) X(5-5) — •- E(l-20) 

Q(l-8) 

B(l-5) 



P(5-20) V(6-20) 

0(5-8) Z(6-8) 

X(5-5) T(6-5) — ► X(2-20) 

L(2-8) 

0(2-5) 



X(2-20) 

L(2-8) 

0(2-5) — B(4-20) 
H(4-5) 
P(4-8) 



T(0-2O) 

H(0-8) 

E(0-5) ► C(3-20) 

V(3-8) 

1(3-5) 



0 ( 3 - 20 ) 

1(3-5) 

V(3-8)- 



E(l-20) 

Q(l-8) 

B(l-5) 



Figure 43. 



(3) These pairs manifestly all belong to the same displacement inter- 
val, and therefore unions can be made Immediately. The complete list is as 
follows: 



EX, QL, HI, LH, HD, BC, OZ, CE, TP, FV, XT, VQ, IB. 

(4) Joining pairs by their common letters, the following sequence is 
obtained: 



. ..NIBCEXTPVQLHOZ... 



COHFIDE HT Iffl C 
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e. With this as a nucleus the cryptogram can be solved speedily and 
accurately. When it is realized that the cryptanalyst can assume THE's 
rather readily in some cases, the value of this principle becomes apparent. 
When it is further realized that if a cryptogram has sufficient text to 
enable the THE's to be found easily, it is usually also not at all diffi- 
cult to make correct assumptions of values for two or three other high-fre- 
quency letters; it is then clear that the principles of indirect symmetry 
of position may often be used vith gratifyingly quick success to reconstruct 
the complete primary component . 

f. When the probable -word method is combined vith the principles of 
indirect symmetry the solution of a difficult case is often accomplished 
vith astonishing ease and rapidity. 

52. Use of the graphical method in the foregoing example. -- a. As an 
illustration of the application of the graphical method of indirect symmetry, 
ve shall use as an example the cryptogram given in par. 49. It is desired 
to reconstruct the original primary component, or an equivalent, from the 
values entered in the reconstruction matrix shown in Fig. 40 on p. 139. 

Since a mixed sequence is sliding against Itself, all the partial sequences 
(pairs or greater) vhich can be established by studying the reconstruction 
matrix are listed as shown in Fig. 44a, below. The single pairs in 0-7 and 
0-6 are crossed out since they offer no data for reconstruction. This yields 
the following groups of partied sequences: 



1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


BW 


EK 


EX 


AE 


Bn 


EJ 


-we- 


-ee- 


IHJ 


HE 


EGZ 


HZ 


TO 


HG 


HCR 


ON 






TS 


17 


TK 


NS 




10 


NP 


HOF 






WA 


NQ 




UF 




TP 















Figure 44a. 



b. (l) The sequences HOF and EJ in group 6 and HE in group 10 are 
notedT The HOF will be placed horizontally and the notation is made 

under group 6. The letter E of the pair HE of group 10 will be placed under 
the H, and the notation Jl added under group 10. Thus: 



1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


BW 


EK 


EX 


AE 


ED 


EJ 


-00- 


•GO- 


IHJ 


HE 


EGZ 


HZ 


TO 


HG 


HCR 


GN 






TS 


17 


TK 


NS 

UF 




10 

TP 


NP 


HOF 






WA 


NQ 








TT 








i 1 



Figure 44b. 

Since the sequence EJ belongs to the same displacement Interval as HOF, the 
letter J can be inserted after the letter E, giving: 

HOF 
E J . 

Figure 45a. 
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No more pairs can be added innediately from groups 6 or 10. Those pairs 
already entered are crossed out in their respective groups and an inspec- 
tion is made for additional data in another group. 

(2) The sequence IHJ is noted in group 9* The letters H and J are 
already entered in the diagram. One can therefore place the letter I, 
and the notation \l is placed under group 9 • The addition of the letter 
I now permits the insertion of the letter V of the sequence IV in group 
10, giving: 

I . • . 

VHOP 

. £ J • 

Figure 45b. 

(3) In group 4 there is the sequence 10 which is obtainable in the 
diagram by the route ll . This notation is made beneath group 4; the 

2 

letter A of the sequence AE and the letter G of the sequence HG can now 
also be entered. The addition of the letter A permits the placement of 
the letter W of the pair WA of group 9; likewise the addition of the let- 
ter G permits the insertion of the letter N of the sequence GN of group 
6j finally, the placement of the letter N permits the placement of the Q 
of group 9. One now has: 



W . I . . . . 

. A V H 0 F . 

. . . E J G N 

Q 

Figure 45 c_. 

(4) Referring to group 1, the sequence EGZ is noted, of which EG 
appears in the diagram at . The letter Z can therefore be placed and 

T* 

the letter B of the sequence BN can be inserted two intervals to the left 
of the letter W, giving: 

B.U.I..... 

. . . A V H 0 F . . 

E J G N Z 

Q . 



Figure 4$d. 

(5) Noting the sequence HZ of group 2 as being graphically repre- 
sented in the diagram by ll , the letters K, S, and U of the sequence 

V 

EK, NS and UF may be placed. Thus: 

B.WUI 

...AVHOF 

• • • . . E J G N Z . . • 

QK..S 

Figure 45e. 
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(6) The letter T of the sequence TK of group 1 can now be placed, 
which permits the addition of the letter P of the sequence TP of group 4. 
A study of the diagram shows the pair TU of group 3 at interval 3 l~ , 

4 

which allows the placing of the letter X of the pair EX of the same group. 
One then has: 



.X 

B.WUI 

...AVHOF 

EJ6IZ. . . 

TQK..S 

P . . . 

Figure 45f . 

(7) The diagram now shows the pair NP of group 5 at 2| ^ , the let- 

1 

ter D of the sequence ED and the letters C and R of HCR can therefore be 
inserted. Thus: 



.X 

B.WUI 

...AVHOF 

EJGSZ. . . 

CTQK..S 

D . . P . . . 

R 

Figure 45£. 

(8) Pair TS of group 9 remains. It has already been noted that the 
notation \ 1 has been applied to group 9* Hence the letter S can also be 
placed one interval to the right and below the T, as shown in Fig. 45h, in 
which all the available data are now entered. 



(1) 


. x . 


• • 


• 


• 


• 


• 


• • • • 


(2) 


B . W 


U I 


• 


• 


• 


• 


t • • • 


(3) 


• • • 


A V 


H 


0 


F 


a 


see# 


(4) 


• • • 


• • 


E 


J 


G 


N 


Z . • . 


(5) 


• • s 


• • 


• 


C 


T 


Q 


K . . S 


(6) 


• e • 


• • 


• 


D 


• 


S 


P . . . 


(7) 


• ■ • 


m a 


• 


m 


R 


• 


• see 



Figure 45h. 



c. (l) The letter S appears in rows (5) and (6) at a displacement 
interval of four. This letter then serves as the "tie-in" letter. Marking 
off 26 squares on cross-section paper the D.SP of row (6) is written, and 



OOHFIDEHTIA & 



151 



REF ID:A64563 



GONFIDENTlffi ' 



row ( 5 ) is moved four intervals to the left, at which position the letter 
S is properly superimposed as follows: 

1 2 8 4 8 8 7 8 8 W 11 12 13 14 U 16 17 18 19 20 21 23 23 24 25 28 

Row (5) CTQK. . S. 

Row ( 6 ) . . . . D . S P 

(2) Likewise row (4) is moved four intervals to the left of its 
original relative position to row ( 5 ) and dropped into position. Row ( 3 ) 
is moved the same distance in relation to row (4), etc. These steps may 
be illustrated as follows: 

1 2 8 4 8 8 7 8 9 10 11 12 13 14 18 18 17 18 19 20 21 22 23 24 28 28 

Row (4) .... E J G H Z CTQKD.SP 

Row (3) HOF .EJGNZCTQKD. SF AV 

Row (2) HOF. EJGNZCTQKD. SP B.HUT . . IT 

(3) The placing of the letter X of row (l) and the letter R of row 
( 7 ) gives the final sequence: 

1 2 3 4 8 6 7 8 » 10 11 12 13 14 18 18 17 18 19 20 21 22 23 24 28 28 

HOF. EJGIZCTQKDXSPBRWUI . .AV 

(4) It will be noted that the foregoing component is identical with 
that obtained in subpar. 50 m( 3 ). 

53 » Additional remarks on the graphical method. — a. In the example 
given above only one tie-in letter was available and it "was located in 
adjacent rows. Although only one is necessary, in most cases several tie- 
in letters are present after all pairs of letters have been entered in the 
diagram; then the superimposed sequences can be easily connected by their 
common letters. If the tie-in letter had appeared in adjacent columns in- 
stead of adjacent rows as in the foregoing example, the columns would have 
been shifted vertically and the sequence taken from the diagram in that 
manner. 

b. When only a few pairs of letters forming partial sequences are 
available, frequently only one tie-in letter may be encountered. If it 
does not occur in adjacent rows or columns the component can still be 
written with additional considerations. For example, adjacent diagonals 
might be used. However, the student will experience no difficulty after 
the application of this method to a few problems. 

c. Since all the data are entered in one diagram, the graphical 
method of reconstruction quickly discloses erroneous assumptions and en- 
ables one to ascertain in a short time whether sufficient data are present 
for the reconstruction of the component. Even if this is not the case, the 
diagram automatically offers new values which may be substituted in the 
cryptogram. One may then assume additional values which can be entered in 
the diagram or which will serve to corroborate sequences already entered. 

d. The placing of the first two sequences of different displacement 
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intervals in the diagram determines the type of sequences that vill be 
established. If the original sequence entered horizontally in the diagram 
is an odd decimation of the primary component, a 26 -let ter sequence can be 
obtained horizontally. If this original sequence is Initially tied in 
vertically with another sequence of an odd decimation interval; a 26-letter 
sequence can also be obtained vertically from the diagram. 

e. (l) In certain instances, however, it will happen that the avail- 
able partial sequences have all resulted from even decimations of the basic 
sequence and that no tie-in letters are present to permit the integration 
of all the data into a single diagram. In such cases the reconstruction of 
the basic sequence may take place by taking data from two or more different 
diagrams, and then, using the relative positions of the letters with ’•aspect 
to each other in these diagrams , the basic sequence may be established. 

This method can best be demonstrated by means of an example, and the follow- 
ing one is based upon the QUEST... sequence of subpar. 46a. Suppose the 
reconstruction diagram from the derivation of a few plaintext -ciphertext 
relationships yields the following partial sequences: 



Group 


l 


2 


3 




✓ QHO 


Q X V 


Q T A 


I 


F T 


0 T 


X E 


1 


C E 


P K 


F K 


Sequences... J 


J N 


F C 


U I B 


7 


WDS 


U Z W 


Z S 


I 




N I 


Y G M 


\ 




G D 





Figure 46. 

(2) The partial sequences in the three groups can be combined to 
form two diagrams. This may be accomplished by considering the sequences 
of group 1 as parts of a horizontal component and those of group 2 as parts 
of a vertical component of a cipher square based upon the original or an 
equivalent primary sequence. When all the letters of these two groups have 
been entered into the two resultant diagrams in Figs. 47a and b, it w ill be 
observed that the positions occupied in these two diagrams by the letters 
of group 3 represent the interval ll . Thus : 

2 



QHO. . 
X F T P . 
V C E K A 



IDJH. . 
. Z G I . . 
. W D S M B 



(a) ' (b) 



Figure . 



(3) It will be noted that there are 12 letters in each of the two 
diagrams and that all the letters appearing in the original partial sequences 
have been included In these two groups. It appears, first, that two 13-let- 
ter sequences are involved and second, that the partial sequences in all 
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three groups represent even decimations of the basic component. The 
problem now remains to reconstruct the original or an equivalent primary 
cipher square to vhich these diagrams belong, or to find the original or 
an equivalent primary component of vhich the partial sequences in groups 
1, 2, and 3 are derivatives. 

(4) Since the two diagrams are linked by the partial sequences of 
group 3 (because the interval ll t is common to both of them) , it follows 

2 

that any two letters in one of the diagrams vill be separated from each 
other in the basic sequence by the same interval as any two letters oc- 
cupying the same relative positions in the other diagram. Another way 
of saying the same thing is, that while the intervals between V and C, 

C and E. E and K, and K and A, in the basic component (or an equivalent 
thereof) are unknown, whatever they may be they are Identical and the 
same as that between W and D, 0 and S, S and M, M and B (from WDSMB), or 
between Y and U, U and J, J and N (from YUJN), and so on. Likewise, Q and 

K (interval 2| ) are separated by the same interval as Y and S, or U and 

3 

M, and so on. 

(5) Making the easiest assumption first, suppose the basic sequence 

is a keyword-mixed sequence, and that the letter Z is the final letter 
thereof. If it is preceded by Y, then, because of the relative positions 
occupied by Y and Z in Fig. 47b, the following would also be sequent in 
the basic sequence: QF, HT, OP, XC, FE, XX, PA; UG, JI, ZD, GS, and IM. 

Since the majority of these are hardly likely to occur in a keyword-mixed 
sequence, the assumption that Y precedes Z is discarded. Suppose X pre- 
cedes Z (implying that Y is in the keyword). But X and Z are not in the 
same diagram, so no test can be made. Suppose the sequence is W.Z. Then 
the following sequences would be valid: 

W . Z . U V . X . Q 

D . G . J C.F.H 

S . I . N E . T . 0 

K . P 

These look very likely. In fact, noting the D.G.J and the C.F.H sequences 
it seems logical to integrate or "dovetail” them thus: CDFGHJ. This then 

suggests that W.Z.U and V.X.Q may be integrated into VWXZQD; S.I.H and 
E.T.O may be integrated into ESTION. From this point on the matter of ex- 
tending the partial sequences into the basic one is simple and rather ob- 
vious . 

f. (l) Suppose, however, that the basic sequence is not a keyword- 
mixed sequence, so that clues of the nature of those employed in the pre- 
ceding subparagraph are no longer available. Then what? 

(2) Referring back to subpar. 53e(2) , it has already been noted that 
the two diagrams, each containing 12 letters, represent half -sequences (of 
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13 letters) derived, from an even decimation of the original component. 

(The decimation must be the same in both cases because the interval 1 U 

2 

is common to them.) Suppose an attest is made to integrate the QHO, XFTP, 
and VCEKA sequences of Fig. 47a into a 13 -let ter cycle in a number of ways 
but the correct integration will be that which will satisfy the condi- 
tions set up by the partial sequences in groups 1, 2, and 3 . After a bit 
of experimentation it is found that the only one which will satisfy all 
conditions is this: 



1 2 S 4 5 C 7 8 8 10 11 12 13 

QHOVCEKAXFTP. 

Note, for example , that the conditions represented by QXV in group 2 are 
satisfied in that the intervals between these letters are the same in the 
13 -letter cycle; the same is true as regards the intervals between 0 and 
T, P and K, and so on. Likewise, the conjugate sequence from Fig. 47 b is 
established as 

1 2 3 4 5 a 7 8 9 10 11 12 13 

YUJIWDSMBZGI . 

Thus there have been established the two half sequences involved. The 
problem now remains to integrate them into a single sequence which is 
either the primary one or an equivalent primary component. 

(3) Each of these sequences may, of course, be expanded to form a 
26-element sequence, the elements of which will satisfy the interval rela- 
tionships among the letters in each 13 -letter sequence. Thus: 

1 2 3 4 5 6 7 8 0 10 It 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

(1) Q.O.C.K.X.T. . .H.V.E.A.F.P. 

(2) Y.J.W.S.B.G. . .U.N.D.M.Z. I. 

Figure 48. 

There remains the problem of integrating these two sequences into a single 
sequence. 

(4) Suppose a start is made thus* 

1 2 3 4 J S 7 8 8 10 11 12 13 14 15 18 17 18 19 20 21 22 23 24 25 26 

QYOJCWKSXBTG. . HUVNEDAMFZPI 

Figure 49. 

All the interval relationships of groups 1, 2, and 3 of Fig. 46 are satis- 
fied by this sequence. If the sequence is written on a pair of sliding 
strips, any even -interval displacement of one of the strips will produce 
plaintext -ciphertext relationships fully satisfied by the requirements of 
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che sequences in Fig. 46 or Fig. 47. Thus: 

QYOJCWKSXBTG. .HUVNEDAMFZPI 
HUVNEDAMFZPIQYOJCWKSXBTG. . 

, . QYOJCWKSXBTG. . HUVNEDAMFZPI 
XBTG. . HUVNEDAMFZPI QYOJCWKS 

. x QYOJCWKSXBTG.. HUVNEDAMFZPI 
TG. . HUVNEDAMFZPIQYOJCWKSXB 

Figure 50. 

The foregoing three juxtapositions will satisfy all the requirements of 
the sequences Indicated in groups 1, 2, and 3 of Fig. 46, as well as those 
indicated in Figs. 47a and b. Without further restrictions or additional 
data, therefore, it is impossible to tell whether the reconstructed single 
sequence is correct or not. In fact, there are 13 possible integrations 
of the two expanded 13-letter sequences which will yield equivalent re- 
sults, since there are 13 positions in which the "dovetailing" of the 
second sequence may be commenced with respect to the first sequence. 

Only one of these, however, will be correct in that it will yield a sin- 
gle sequence which, when slid against itself at all juxtapositions (both 
odd and even displacements) will invariably yield the full quota of plain- 
text -ciphertext relationships that the original basic or an equivalent 
primary component yields when slid against itself. (An incorrect integra- 
tion will often yield a series of equivalents of which only a few are 
wrong.) 

( 5 ) The correct integration will, however, be disclosed quickly 
enough when the cryptanalyst refers to the cipher text and one or two 
additional values are derived. Thus, suppose an additional word iB de- 
ciphered and it yields a pair of values in a new secondary alphabet, for 
example , A p - D c and Up ■ 0 C . The single sequence reconstructed as shown 
in Fig. 49 will not yield this pair of values, as seen in the following 
juxtaposition of the sliding strips: 

QYOJCWKSXBTG. . HUVNEDAMFZPI 
IQYOJCWKSXBTG. . HUVNEDAMFZP 

Figure 51. 

Here Ap * Dc but Up ■ H c , not 0 C . However, if the "dovetailing" is com- 
menced with the letter S of Fig. 4b and the resultant 26 -letter sequence 
is juxtaposed against Itself as shown in Fig. 52, it will be found that 
the sequence will now satisfy all the requirements. 

QSOBCGK. X U T N . DHMVZEIAYFJPW 
IAYFJPWQSOBCGK. XUTN . DHMVZE 

Figure 52. 

The sequence is, of course , a decimation of the QUESTIONABLY... sequence, 
at the third interval. 
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5U. Solution of subsequent messages enciphered, by the gang prlaar^ 
components . --a. In the discussion of the methods of solving repeating-key 
ciphers us ing — secondary alphabets derived from the sliding of a mixed com- 
ponent against the normal component (Chapter V) , it vas shown how subsequent 
messages enciphered by the same pair of primary components but with differ- 
ent keys could be solved by application of principles involving the comple- 
tion of the plain-component sequence (pars. 33, 3*0 . The present paragraph 
deals vlth the application of these same principles to the case where the 
primary components are identical mixed sequences. 

b. Suppose that the following primary component has been reconstructed 
from the analysis of a lengthy cryptogram: 

QUESTIONABLYCDFGHJKMPRVWXZ 

A new message exchanged between the same correspondents is intercepted and 
is suspected of having been enciphered by the same primary components but 
with a different key. The message is as follows: 

NFWWP NOMKI WPI DS CAA ET QVZSE Y 0 J S C 

t A A A F G RVNHD W D S C A EGNFP FANBN KRVSA 

C W D S L OUFAZ NCVXB IUWAG SJCFG 

c. Factoring discloses that the period Is 7 letters. The text is 
transcribed accordingly, and is as follows: 

N F V W P N 0 
MKIWFID 
SCAAETQ 
V Z S E Y 0 J 
S C A A A F G 
RVDEDHD 
S C A E G N F 
PFABBKK 
R V S A C V D 
S L 0 U F A Z 
N C V X B I U 
W A G S J C F 
G 

Figure 53* 

d. The letters belonging to the same alphabet are then employed as 
the initial letters of completion sequences, in the manner shown in par. 

33e, using the already reconstructed primary component. The completion 
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diagrams for the first 10 letters of the first three alphabets, together 
vith the 2 -category scores, are as follovs: 



Gen. 


Alphabet 1 


1 


7 NMSVSRSPRS 


2 


6 QPTWTVTEVT 


3 


5 BRIXIWIWI 


4 


-LVOZOXQWSO- 


5 


-■YWNQNZNXZN - 


6 


CXAUAQAgQA 


7 


DgBEBUBQUB- 


8 


3 FQLSLELUEL 


9 


4 GUYTYSYESY 


10 


5 HECICTCSTC 


11 


5 JSDODIDTID 


12 


5 KTFNFOFIOF 


13 


5 MIGAGNGONG 


14 


4 POHBHAHNAH 


15 


HMJLJBJABJ 


16 


VAKYKLBBUt- 


17 


0 WBMCMYMLYM 


18 


0 XLPDPCFYCP 


19 


4 ZYRFRDRCDR 


20 


0 QCVGVFVDFV 


21 


0 UEWHWGWFGW 


22 


EFXJXHXGBX 


23 


-eegtEBjgaja- 


24 




25 


IJUPUMUKMB 


26 


6 OKEREPEMPE 



Alphabet 2 
FKOZGVG FVL- 

0 GMDQDWDGWY 
-j ffFUFXF ffi ffl - 

■ J RQ B SgO J BB - 
KVH B H Q gKQF 

- M WfflJ B U H BB- 

■ PXK3KEKP B H- 
RgMOMSMRSJ 
VqPHPTPV lK- 

6 WURARIKWIM 
- 3 E BVBVOVXOP - 
a S WIAfflWZ S R - 
QTXYXAXQ/W - 
UIZCZBZUBW 
BOQPQJj^ELX 
3 SNUFUYUSYZ 
6 TAEGECETCQ 

5 IBSHSDSIDU 

6 OLTJTPTOFE 
6 NYIKIGIRGS 
6 AC0M0H0AHT 

BDNPNJNBJI - 

- LF A RAKALKO - 

1 YGBVBMBYMN 
1 CHLWLPLCPA 

DJYXYBYDRB - 



Alphabet 3 
9 WIASAMAASO 

3 XOBTBABBTN 

4 ZMLILBLLIA 
3 QAYOYLYYOB 

2 HBCNCYCCHL 

3 ELDADCDDAY 
1 SYFBFDFFBC 
1 TCGLGFGGLD 
1 IDHYHGHHYF 

OFJOJBJJeO 

- HQKBKHS Bfr 

*miraMinAmT_ 
nrn'U' I’uu'tt'ii' u 

BJPGPMPPOK 

4 LKRHRPRRHM 
-flWJVKW JF 

CPWKWW ft O »- 

DRXMXWXX M V 

FVZPZXZa PW- 



hxdvuquuvz 

JZEWEUEiWQ - 

KQgXBE S SXU 

MUTZT S TTZE 

PEIQXTII QB 

8 RSOUOIOOUT 

9 VTNENONNEI 



Figure 



e. Hie determination of the correct generatrices in Fig. 54 is now 
an easy matter, however, since in this case the 2 -category scores do not 
at once point to the correct generatrices, a slight experimentation is 
necessary to arrive at the solution. Logarithmic weights may here be 
used to by-pass further experimentation; the few generatrices having the 
best 2-category scores in Fig. 54 are set forth below, with their loga- 
rithmic scores: 
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1 


7 NMSVSRSPRS 




10 


6 WURARIKWIM 




1 


9 W1ASANAAS0 






8685888688 


= 73 




5688888586 


= 70 




5888888888 


s 77 


2 


6 APTWTVTRVT 




17 


6 TAEGECETCQ 




26 


9 VTNENONNEI 






8695959859 


- 73 




9895979972 


» 74 




5989888898 


■ 80 


26 


6 OKEREPEMPE 




19 


6 OLTJTFTOFE 




25 


8 RSOUOIOOUT 






8298969669 


- 72 




8791969869 


• 72 




8886688869 


. 77 


3 


5 BRIXIWIVWI 




20 


6 NYIKIGINGS 












4883858558 


- 62 




8682858858 


■ 66 








10 


5 HECICTCSTC 




21 


6 ACCMOHOAHT 












7978797697 


- ?8 




8786878879 


- 76 








11 


5 JSDODIDTID 




18 


5 IBSHSDSIDU 












1878787987 


■ 70 




8487878876 


- 71 









12 5 KTFHFOFIOF 

2966686886 » 6? 



13 5 MIGAGNGONG 

6858585885 « 66 

Ihe correct generatrices, as shown by the highest logarithmic scores, are 
now assembled in columnar fashion and yield the following plain text: 

123 ^ 56 ? 

H A V 
E C T 
COB 
I M E 
CON 
T H 0 
CON 
SAN 
THE 
C T I 

Figure 55* 

f. The corresponding key letters are sought, using enciphering equa- 
tions ~%/ c ■ ©i/p ; 0p/p ■ 0 c /c> and are found to be JOU, which suggests the 
key word JOURNEY, among others. Testing the key-letters KNEY for alphabets 
It, 5 , 6 , and 7 , the following results are obtained: 

1 2 3 4 5 6 7 

JOURNEY 
N F W W P N 0 
HATEDIR 

HKIHPID 

EC7EDSE 

Figure 56 . 
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The message may now be completed with ease. It is as follows: 



JOURHEY 
SFVVFIO 
HAVEDIR 

M K I W P I D 
E C T E D S E 

S C A A E T Q 
CONDREG 

V Z S E I 0 J 
IMEHITO 

SCAAAFG 
CONDUCT 

R V N H D W D 
T H 0 R 0 R E 

S C A E G N F 
C 0 N N A I S 

Figure 57* 

g. Another method for the solution of cryptograms when the primary 
components have been recovered might be mentioned at this point. This 
method, based on the analysis of the uniliteral frequency distributions 
of the individual monoalphabets, is applicable when there are a sufficient 
number of tallies (say, at least 25 or so) in each distribution; in such 
situations this method is often easier and quicker than the generatrix 
method treated in the preceding subparagraphs. 



JOURNEY 
P F A N B N K 
S A N C E I N 

R V S A C W D 
T H E D I R E 

S L 0 U F A Z 
C T I 0 N 0 F 

N C V X B I U 
H 0 R S E S H 

WAGSJCF 
0 E F A L L S 

G 

X 



(l) Let us assume that the enemy has been using keyword-mixed 
sequences based on QUESTIONABLY for the primary components, and that the 
following message (factoring to five alphabets) with its accompanying 
frequency distributions are at hand: 



P F 0 F R 
QFZBV 
DDHYK 
D D X B W 
D D A X 0 



V V Z D V 
F B U K V 
QJLIR 
F C H A 0 
G B W L T 



Q G Q Y I 
A U S B Y 
P A A W R 
3 F X A K 
U H S Y X 



EFQJH 
M U S K P 
LB QFK 
E D X 0 E 
H H W Y V 



H J I C Y 
M C E A R 
C D X A X 
Y C H N P 
TKUBL 



V A B L Y 
F N W I L 
J H S A R 
DQXOE 
J A Z 0 S 
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(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

■ Ball s - * = - _ _ « _ 

(2) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

, . - - - - - - - ■ s m ei s 

(3) ABCDEFGHIJKLMKOPQRSTUVWXYZ 

(U) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(5) ABCDEFGHIJKLMKOPQRSTUVWXYZ 

In spite of the flatness of the distribution for Alphabet 1 (I.C. 
there is no doubt but that the period is 5. 



1 . 08 ), 



(2) Consider the frequency distribution for the second alphabet, 
vhich has several pronounced peaks. The cipher letters D, F, A, B, C, 
and H are high, with Dc being the highest. In general, these letters 
should represent most of the high-frequency plaintext letters such as E, 

T, K, R, 0 , A, I, S, etc. Nov prepare two strips bearing keyword-mixed 
sequences based on QUESTIONABLY, the plain -component strip should be 26 
letters long, the cipher -component strip doubled length of 52 letters. 
Place the D c on the cipher (long) strip under the Ep on the plain (short) 
strip, and note what plaintext values of F c , Ac, B e , C c , and He are con- 
comitant with D c ■ Ep. Then place Dc on the cipher Btrip under Tp, N p , 

Rp, etc. in turn, noting what plaintext values of the other cipher letters 
correspond to each setting. When the correct juxtaposition is made, the 
values of all the cipher letters in Alphabet 2 became known, and the fre- 
quencies of the plaintext letters will approximate fairly closely their 
normal frequencies. 

(3) After the correct placement of Alphabet 2 is found, the values 
for the cipher letters are entered in their proper places in the message. 
Then the same procedure is applied to each alphabet in turn, and the 
plaintext values are entered in the message when the correct Juxtaposition 
for the strip is determined. It will be found that the easiest process is 
to treat the distributions with the most striking peaks (such as those of 
Alphabets 2 and 3) first, leaving the flattest distributions (such as that 
of Alphabet l) until last. Furthermore, after several alphabets have been 
correctly determined, the clusters of plaintext fragments in the message 
might suggest complete words, or recovery of part of the key might suggest 
the entire repeating key, thus rendering unnecessary the placement of the 
remaining alphabets by the analytic process just described. The solution 
of this problem is left to the student as an exercise in the foregoing 
method. 
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55. Solution of repeating -key ciphers in which the identical mixed 
components proceed in opposite directions . --The secondary alphabets in 
this case (Case II cl (bj of par. ttj are reciprocal. The steps in solu- 
tion are essentially the same as in the preceding case (par. 4l), the 
principles of indirect symmetry of position can also he applied with the 
necessary modifications introduced by virtue of the reciprocity existing 
within the respective secondary alphabets (subpar. 44j>). 

56. Solution of repeatlng-key ciphers in which the prigary components 
are different mixed sequences . --This is Case II c 2 of par. 8. The steps 
in solution are essentially the same as in pars .”4l and 44, except that 

in applying the principles of Indirect symmetry of position it is necessary 
to take cognizance of the fact that the primary components are different 
mixed sequences (subpar. 44g). 



57. Solution of subsequent messages after the primary components 
have been recovered.- - a. In the cue in which theprimary components are 
identical mixed sequences proceeding in opposite directions, as well as 
in the case in which the primary components are different mixed sequences, 
the solution of subsequent messages 7 is a relatively easy matter. In both 
cases, however, the student must remember that before the method illustrated 
in par. 54 can be applied it is necessary to convert the cipher letters into 
their plain -component equivalents before completing the plain-conq>onent 
sequence. From there on, the process of selecting and assembling the pro- 
per generatrices is the same as usual. 



b. Perhaps an example may be advisable. Suppose the enemy has been 
found - to be using primary components based upon the keyword QUESTIONABLY, 
the plain component running from left to right, the cipher component in 
the reverse direction. The following new message has arrived from the 
intercept station: 



M V X 0 X 


B Z I Y Z 


ILVZE 


0 X I E 0 


0 0 E P Z 


F X S R X 


E J B S H 


B08AD_ 


R A P Z I 


N R_A M V 


X 0 X A I 


J Y X W F 


K N D 0 W 


J E R C U_ 


R A LVB_ 


Z A Q U W 


J W X Y I 


D G R K D 


Q B D R M 


QECYV 


Q W 









c. Factoring discloses that the period is 6 and the message is 
accordingly transcribed into 6 columns, Fig. 58. The first 10 letters 



1 That is messages intercepted after the primary components have been reconstructed and enciphered 
by keys different from these used m the messages upon which the reconstruction of ±e primary components 
was accomplished 
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of these columns are then converted into their plain -component equivalents 
by juxtaposing the tvo primary components at any point of coincidence, for 
example, Qp ■ Z c . The converted letters are shown in Fig. 59« The letters 



12 3 4 5 6 
M V X 0 X B 

zinm 

W Z H 0 X I 
E 0 0 0 E P 
Z F X S R X 
EJBSHB 
ON AURA 
P Z I N R A 
M V X 0 X A 
I J Y X W F 
K N D 0 W J 
E R C U R A 
LTBZAQ 
UWJHXY 
IOGRKD 
QBDRMQ 
E C Y V Q W 

Figure 58. 



12 3 4 5 6 
0 S U M U H 
QPFQKG 
EQBHUP 
W H M M W I 
QYUVTU 
W A H V B H 
HKJX1J 
IQPKTJ 
0 S U M U J 
P A F U E Y 

Figure 59 . 



of the individual columns are then used as the initial letters of comple- 
tion sequences, using the QUESTIONABLY primary sequence. The final step 
is the selection and assembling of the selected generatrices. The results 
for the first ten letters of the first three columns are shown below: 
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Alphabet 2 



5 IVERDLPEIL 
5 OWSVFYRSOY 
4 mWGCVTNC 



Alphabet 



4 SHYRSKMVSH 
3 TJCVTMFWTff 



8 4 

9 5 

10 4 

11 4 

12 

13 - 

14 2 

15 2 

16 3 

17 1 

18 - 

19 

20 
21 
22 

23 2 



DKBTNTQCDU 

FALLIAIUDFE 

GBYOBOEFGS 

HLCNLHSGHT 



MDGLDLOKMH 

PFHXFISMPA 

RGJCGCAPRB 

VHKDHDBRVL 



3 YEAUMHQAYH 



3 FIYTVMSYFM 
3 GOCIWPTCGP 
5 HNDOXRIDHR 



1 VDMCTUYMVU 
3 WFFDIECFHE 



EVXMVMGUEH 



4 FUVOFSTHFU 
6 GEWKGTIAGE 

5 HSXAHIOBHS 



3 MOUYMABCMO 
3 PNECPBLDPH 
6 RASDRLYFRA 
1 VBTFVYCGVB 
1 WLIGWCDHHL 



Figure 60. 

Columnar assembling of selected generatrices gives what is shown In 
Fig. 61. 

1 2 3 4 5 6 

FIR... 

HA. . . 

L £ S . • • 

I R D . . . 

ADR. . . 

ILL. . . 

U P Y . . . 

D E F . . . 

FIR. . . 

E L A . . . 

Figure 61. 
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d. The key letters are sought, and found to he HUM, which suggests 
HUMBER. The entire message may now he read with ease. It Is as follows 



HUMBER 



HUMBER 



M V X 0 X B 
F I R S T C 

znzu 

A V A L R Y 

W Z H 0 X I 
L E S S T H 

E 0 0 0 E P 

iBOsqu 

Z F X S R X 
A D R 0 N W 

E J B S H B 
1 L L 0 C C 

0 N A U R A 
U P Y A H D 

P Z I H R A 
D E F E H D 

M V X 0 X A 
F I R S T D 



Figure 62. 



IJYXWF 
E L A Y I N 

K N D 0 V J 
G P 0 S I T 

E R C U R A 
I 0 H A H D 

LVBZAQ 
W I L L P R 

U W J W X Y 

0 T E C T L 

IDGRKD 
E F T F L A 

QBDRMQ 

HKOFBfi 

ECYVQW 

1 G A D E X 



e. If the primary components are different mixed sequences, the 
procedure is identical with that Just indicated. The important point to 
note is that one must not fall to convert the cipher letters into their 
plain-component equivalents before the completion-sequence method Is ap- 
plied. 
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CHAPTER VIII 

SPECIAL SOLUTIONS FOR PERIODIC CIPHERS 

Paragraph 
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Solution of isologs involving the same pair of unknown primary components but with key words 
of different lengths . 61 

Solution of isologs involving different pairs of unknown primary components . 62 

Solution of a pair of periodic cryptograms involving a "stagger" . . 63 

Solution of a periodic cryptogram containing a long latent repetition . . 64 

Solution by superimposition , . 65 

Additional remarks 66 



58. General remarks . — The preceding two chapters have been devoted to 
an elucidation of the general principles and procedure in the solution of 
typical cases of repea ting -key ciphers. This chapter will be devoted to a 
consideration of the variations in cryptanalytic procedure arising from 
special circumstances. It may he well to add that by the designation 
"special circumstances" it is not meant to imply that the latter are nec- 
essarily unusual circumstances. The student should always be on the alert 
to seize upon any opportunities that may appear in which he may apply the 
methods to be described . In practical work such opportunities are by no 
me arm rare and are seldom overlooked by competent and experienced crypt- 
analysts . 

59. Deriving the secondary alphabets, the primary components, and 
the repeating key, given a cryptogram with its plain text.- - a. It may 
happen that a cryptogram and its equivalent plain text are at" hand, as 
the result of capture, pilferage, compromise, etc. Ibis, as a general 
rule, affords a very easy attack upon the whole system. 

b. Taking first the case where the plain component is the normal 
sequence, the cipher component a mixed sequence, the first thing to do is 
to write out the cipher text with its letter -for -letter decipherment. 

From this, by a slight modification of the principles of "factoring”, one 
discovers the length of the key. It is obvious that when a word of three 
or four letters is enciphered by the same cipher text, the interval between 
the two occurrences is almost certainly a multiple of the length of the key. 1 



1 Again, as a note of caution see the remark made in footnote 6 on p 32 
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By noting a few recurrences of plain text and cipher letters, one can 
quickly determine the length of the key (assuming of course that the 
message is long enough to afford sufficient data). Having determined 
the length of the key, the message is rewritten according to its peri- 
ods, vith the plain text likewise in periods under the cipher letters. 

From this arrangement one can now reconstruct complete or partial second- 
ary alphabets. If the secondary alphabets are complete, they will show 
direct symmetry of position; if they are but fragmentary in several alpha- 
bets, then the primary component can be reconstructed by the application 
of the principles of direct symmetry of position. 

c. If the plain component is a mixed sequence, and the cipher com- 
ponent the normal (direct or reversed sequence), the secondary alphabets 
will show no direct symmetry unless they are arranged in the form of 
deciphering alphabets (that is, Ac...Z c above the zero line, vith their 
equivalents below). The student should be on the lookout for such cases. 

d. (1) If the plain and cipher primary components are identical 
mixed~sequences proceeding in the same direction, the secondary alphabets 
will show indirect symmetry of position, and they can be used for the 
speedy reconstruction of the primary components (BubparB. 44a to m). 

(2) If the plain and the cipher primary components are identical 
mixed sequences proceeding in opposite directions, the secondary alpha- 
bets will be completely reciprocal secondary alphabets and the primary 
component may be reconstructed by applying the principles outlined in 
subpar. 44n, 

(3) If the plain and cipher primary components are different mixed 
sequences, the secondary alphabets will show Indirect symmetry of position 
and the primary components may be reconstructed by applying the principles 
outlined in subpar. 44o. 

e. In all the foregoing cases, after the primary components have 
been reconstructed, the keys can be readily recovered. 

60. Solution of lsologs Involving the same pair of unknown primary 
components but with different key words of identical length. — a. The 
simplest case of this kind is that involving two monoalphabetic substitu- 
tion ciphers vith mixed alphabets derived from the same pair of sliding 
components . An understanding of this case is necessary to that of the 
case involving repeating -key ciphers. 

(l) A message is transmitted from Station "A" to Station "B n . "B" 
then sends "A" some operating signals which indicate that n B" cannot de- 
cipher the message, and soon thereafter "A” sends a second message, iden- 
tical in length with the first. This leads to the suspicion that the plain 
text of both messages is the same. The intercepted messages are superim- 
posed. Thus: 

1. NXGRV MPUOF ZQVCP VWERX QPZVX WXZQE TBDSP WXJK RFZWH ZUWLU IYVZQ FXOAR 

2. EMLHJ FGVUB FRJNG JKWHM RAPJM KMPKW ZTAXG JJMCD HBPKY PVKIV QQJFR BMUSH 
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(2) Initiating a chain of ciphertext equivalents from Message 1 to 
Message 2, the following complete sequence is obtained: 

1 2 3 4 8 « 7 8 9 10 11 12 13 14 IS 18 17 IS M 20 21 22 23 24 25 28 

NEWKDASXMFBTZPGLIQRHYOUVJC 

(3) Experimentation along already -indicated lines soon discloses the 
fact that the foregoing component is an equivalent primary component of 
the original primary cipher component based upon the keyword QUESTIONABLY, 
decimated on the 21st interval. Let the student decipher the cryptogram. 

( 4 ) The foregoing example is somewhat artificial in that the plain 
text was consciously selected with a view to making it contain every let- 
ter of the alphabet. The purpose in doing this was to penult the con- 
struction of a complete chain of equivalents from only two short messages, 
in order to give a simple illustration of the principles involved. If the 
plain text of the message does not contain every letter of the alphabet, 
then only partial chains of equivalents can be constructed. These may be 
united, xf circumstances will permit, by recourse to the various principles 
elucidated in par. 44 . 

( 5 ) The student should carefully study the foregoing example in order 
to obtain a thorough comprehension of the reason why it was possible to re- 
construct the primary component from the two cipher messages without having 
any plain text to begin with at all. Since the plain text of both messages 
is the same, the relative displacement of the same primary components in 
the case of Message 1 differs from the relative displacement of the same 
primary components in the case of Message 2 by a fixed interval. Therefore, 
the distance between'N and E (the first letters of the two messages), on 
the primary component, regardless of what plaintext letter these two cipher 
letters represent, is the same as the distance between E and W (the 13th 
letters), W and K (the 17th letters), and so on. Thus, this fixed interval 
permits of establishing a complete chain of letters separated by constant 
Intervals and this chain becomes an equivalent primary component. 



b. With the foregoing basic principles in mind the student is ready 
to note the procedure in the case of two repeating-key ciphers having iden- 
tical plain texts. First, the case in which both messages have key words 
of identical length but different compositions will be studied. 



e. (1) Given the following two cryptograms suspected to contain the 
same plain text: 



Y H Y E X 


U B 


N G K F A 


Z E 


C G S L Z 


QU 


Z W M D Q 


N S 



U K A 
F I Z 



B M N 
D W N 



Message 1 
P V L L T A B 
B D J E Z A L 

Message 2 

C T Y B V H L 
L C B L Q N E 



UVV DYSAB 
VID TROQS 



QFT FLRHL 
TOC VSNZR 



P C Q T U 
U H A F K 



M T A I Q 
B J N 0 Q 
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(2) The first step is to try to determine the length of the period. 
The usual method of factoring cannot be employed because there are no 
long repetitions and not enough repetitions even of digraphs to give any 
convincing indications. However, a subterfuge will be employed based 
upon the theory of factoring. 

d. (l) Let the two messages be superimposed: 

1 2 3 4 S C 7 8 9 10 U .2 13 14 18 18 17 18 IS 20 21 22 23 24 25 28 27 28 29 30 

1. YHYEXUBUKAPVLLTABUVVDYSABPCQTU 

2. CGSLZQUBMNCTYBVHLQFTFLRHLMTAIQ 

31 32 33 34 35 38 37 38 39 40 41 42 43 44 43 46 47 48 49 SO 61 52 53 54 <SS 56 87 88 69 e0 

1. NGKFAZEFIZBDJEZALVIDTROQSUHAFK 

2. ZWMDQNSDWNLCBLQNETOCVSNZRBJNOQ 

(2) Now let a search be made of cases of identical superimposition. 

4 44 6 18 30 

For example , s and E are separated by 40 letters, u , ^ an d U are S epa- 

L L Q Q Q 

rated by 12 letters. Let these intervals between identical superimposi- 

tions be factored, just as though they were ordinary repetitions. That 
factor which is the most frequent should correspond with the length of the 
period for the following reason. If the period is the same and the plain 
text is the same in both messages, then the condition of identity of super- 
imposition can only be the result of identity of encipherments by identical 
cipher alphabets. This is only another way of saying that the same rela- 
tive position in the keying cycle has been reached in both cases of iden- 
tity. Therefore, the distance between identical superimpositions must be 
either equal to or else a multiple of the length of the period. Hence, 
factoring the intervals must yield the length of the period. The complete 
list of intervals and factors applicable to cases of identical superim- 
posed pairs is as follows: 



Repetition 


Interval 


Factors 


1st EL to 2d EL. . . 


40 


2, 4, 5, 8, 10, 20. 


1st UQ to 2d UQ. . . 


12 


2, 3, 4, 6. 


2d UQ to 3d UQ. . . . 


12 


2, 3, 4, 6. 


1st UB to 2d UB... 


48 


2, 3, 4, 6, 8, 12, 24. 


1st KM to 2d KM... 


24 


2, 3, 4, 6, 8, 12. 


1st AN to 2d AN. . . 


36 


2, 3, 4, 6, 9, 12, 18. 


2d AN to 3d AN.... 


12 


2, 3, 4, 6. 


1st VT to 2d VT. . . 


8 


2, 4. 


2d VT to 3d VT 


28 


2, 4, 7, 14. 


1st TV to 2d TV... 


36 


2, 3, 4, 6, 9, 12, 18. 


1st AH to 2d AH... 


8 


2, 4. 


1st BL to 2d BL... 


8 


2, 4. 


2d BL to 3d BL.... 


16 


2, 4, 8. 


1st SR to 2d SR... 


32 


2, 4, 8, 16. 


1st FD to 2d FD... 


4 


2. 


1st ZN to 2d ZN... 


4 


2. 


1st DC to 2d DC... 


8 


2, 4. 
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(3) The factors 4 and 2 are the only ones common to every one of 
these intervals , and, since a period of 2 is not very probable, it may 
be taken as beyond question that the length of the period is h. 

e. Let the messages now be superimposed according to their periods: 



1 . 


Y H Y E 


X U B U 


K A P V 


L L T A 


B U V V 


D Y S A 


B P C Q 


2. 


C G S L 


Z Q U B 


M N C T 


Y B V H 


L Q F T 


F L R H 


L M T A 


1 . 


TUNG 


K F A Z 


E F I Z 


B D J E 


Z A L V 


I D T R 


0 Q S U 


2. 


I Q Z W 


M D Q N 


SOWN 


L C B L 


Q N E T 


0 C V S 


N Z R B 



1. H A F K 

2. JHOQ 

f. (1) Now distribute the superimposed letters into a reconstruction 
matrix, thus: 



0 A BCDEFGHIJKLMNOPQRSTUVWXYZ 



1 


L 


F S 




J 0 


M Y 


N 


I 




Z C Q 


2 


N 


C 


D 


G 


B 


M Z 




Q 


L 


3 


Q U T 




0 


W 


B E 


Z C 


R V 


F 


S 


k 


H 


L 


W 




Q 


A S 




B T 


N 



(2) By the usual methods, construct the primary or an equivalent 
primary component. Taking lines 0 and 1, the following sequences are 
noted: 

BL, DF, ES, HJ, 10, KM, LY, ON, TI, XZ, YC, ZQ. 

which, vhen united by means of common letters and study of other sequences, 
yield the complete original primary component based upon the key word 
QUESTIONABLY: 

QUESTIONABLYCDFGHJKMPRVWXZ 

(3) The fact that the pair of lines with which the process was com- 
menced yield the original primary sequence is purely accidental, it might 
have just as well yielded an equivalent primary sequence. 

(1) Having the primary cipher component, the solution of the 
messages is now a relatively simple matter. An application of the method 
elucidated in par. 5*t is made, involving the completion of the plain-com- 
ponent sequence and the selection of those generatrices which contain the 
best assortment of high frequency letters. 2 Thus, using Message 1: 



2 We are assuming in this case that the plain component is identical with the cipher component If this 
is not the case subpars 61f and g outline the procedure to be followed in such situations 
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Gen. Alphabet 1 


Alphabet 2 Alphabet 3 


Alphabet 4 


* 




(2) In this particular case, It is easy to pick out the correct 
generatrices for Alphabets 2, 3> and. 4, since the correct ones have the 
highest two-category scores. These generatrices are assembled in colum- 
nar fashion in Fig. 63a, below; from this step it is easy to see that 
the correct generatrix for Alphabet 1 is Generatrix No. 24, as is shown 
in Fig. 63b: 



12 3 4 


12 3 4 


. L L A 


ALLA 


.RAN 


R R A N 


. E M E 


G E H E 


. T S F 


N T S F 


. R R E 


0 R R E 


. I E F 


LIEF 


. F Y 0 


0 F Y 0 


. R 0 R 


U R 0 R 


. A N I 


G A N I 


.ATI 


Z A T I 


Figure 63a. 


Figure 63 b. 
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(3) The key letters are sought aud give the key word SOUP. The 
plain text for the second message Is now known, and by reference to the 
cipher text and the primary components, the key word for this message is 
found to be TIME. The complete texts are as follows: 

SOUP TIME 

Y H Y E CGSL 

ALLA ALLA 

XUBU Z Q U B 

RRAN RRAN 

K A P V MB C T 

GEME GEME 

LLTA IBVH 

NTSF NTSF 

BUVV LQFT 

ORRE ORRE 

D Y 3 A FLRH 

LIEF LIEF 

BPCQ LMTA 

OFYO OFYO 

TUNG I Q Z W 

UROR UROR 

KFAZ HD QN 

GANI G A N 1 

EFIZ SDWN 

ZATI ZATI 

BDJE LCBL 

ONHA 0 N H A 

Z A L V QNET 

VEBE VEBE 

IDTR OCVS 

ENSU ENSU 

OQSU RZRB 

SPEN SPEN 

HAFK J N 0 Q 

DEDX DEDX 

Figure 64. 

61. Solution of isologs involving the same pair of unknown primary 
components but with key words of different lengths. - -a. In the fore- 
going case the key words for the two messages, although different, were 
identical in length. When this is not true and the key words are of 
different lengths, the procedure need be only slightly modified. 
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b. Given the following two cryptograms suspected of containing 
the same plain text enciphered by the same primary components but with 
different key words of different lengths, solve the messages. 

























Message 


No. 


1 


























V 


M Y 


Z 


G 


E 


A U 


N 


T 


P 


K 


FAY 


J 


I 


Z 


M B 


U 


M 


Y 


K 


B 


V 


F 


I 


V 


V 


s 


E 


0 


A 


F 


S 


K X 


K 


R 


Y 


W 


C A C 


Z 


O 


R 


D 


0 


z 


R 


D 


E 


F 


B 


L 


K 


F 


E 


s 


M K 


S 


F 


A 


F E 


K 


V 


Q U 


R C M 


Y 


Z 


V 


0 


X 


V 


A 


B 


T A 


Y 


Y 


U 


O 


A 


Y 


T D 


K 


F 


E 


N W 


N 


T 


D 


B 


Q K U 


L 


A 


J 


L 


Z 


I 


0 


U 


M 


A 


B 


0 


A 


F 


3 


K 


X 


Q 


P 


U 


Y 


M J 


P 


W 


Q 


T 


BBT 


0 


S 


I 


Y 


S- 


M 


I 


Y 


K 


U 


R 


O 


G 


M W 


C 


T 


M 


Z 


Z 


V 


M V 


A 


J 




























































Message 


No. 


2 


























Z 


G 


A 


N 


W 


I 


0 M 0 


A 


C 


0 


DBA 


C 


L 


R 


L 


P 


M 


O 


Q 


O 


J 


E 


M 


0 


Q 


U 


D 


H 


X 


B 


Y 


U 


Q M 


G 


A 


U 


V 


GLQ 


D 


B 


S 


P U 


0 


A 


B 


I 


R 


P 


W 


X 


Y M 


O 


G 


G 


F 


T 


M R H V 


F 


G 


w 


K N I 


V 


A 


u 


P 


F 


A 


B 


R 


V 


I 


L 


A 


Q 


E 


M 


Z 


D 


J 


X 


Y 


M 


E D 


D 


Y 


B 


0 


S V M 


P 


N 


L 


G 


X 


X 


D 


Y 


D 


O 


P 


X 


B 


Y 


U 


Q M 


H 


K 


Y 


F 


L U 


Y 


Y 


G 


V 


PVR 


D 


N 


C 


Z 


E 


K 


J 


Q 


O 


R 


W 


J 


X 


R 


V 


G 


D 


K 


D 


S 


X 


C E 


E 


C 







































c. The messages are long enough to show a few short repetitions 
which~permit factoring. The latter discloses that Message 1 has a period 
of h and Message 2, a period of 6 letters. The messages are superimposed, 
with numbers marking the position of each letter in the corresponding peri- 
od, as shown below: 

1234123412341294X2341234 

No 1 VMYZGEAUNTPKFAYJ IZMBUMYK 
No 2 ZGANWIOMOACODHACLRLPMOQO 

128456123430123430123458 

123412341234123412341234 

No 1 BVFIVVSEOAFSKXKRYWCACZOR 
No 2 JEMOQUDHXBYUQMGAUVGLQDBS 

123450123450123450123430 

123412841234123412341234 

No 1 DOZRDEFBLKFESMKSFAFEKVQU 
No 2 PU0ABIRPWXYM0GGFTMRHVFGW 

123456123450123450123456 

123412341234123412341234 

No 1 RCMYZVOXVABTAYYUOAYTDKFE 
No 2 KNIVAUPFABRVILAQEMZDJXYM 

123456123450123450123450 

123412341234123412341234 

No 1 NWNTDBQKULAJLZI0UMAB0AFS 
No 2 EDDYBOSVMPNLGXXDYDOPXBYU 

123466123450123456123456 

123412341284123412341234 

No 1 KXQPUYMJPWQTDBTOSIYSMIYK 
No 2 QMNKYFLUYYGVPVRDNCZEKJQO 

123456123450123466123450 

1234123412341234 

No 1 UROGMWCTMZZVMVAJ 
No 2 RWJXRVGDKDSXCEEC 

1234601234001234 
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d. A reconstruction matrix of "secondary alphabets" is now made 
(cf. Fig. 65) by distributing the letters in respective lines corres- 
ponding to the 12 different superimposed pairs of numbers. For example, 
all pairs corresponding to the superimposition of position 1 of Message 
1 with position 1 of Message 2 are distributed in lines 0 and 1 of tne 



matrix. Thus, the very first superimposed pair 



$ 



the letter Z is 



inserted in line 1 under the letter V. Hie next £ j pair is the 13th super- 
imposition, with the letter D is inserted in line 1 under the letter F, 



and so on. The matrix is then as follows: 



i 

1- 1 

2- 2 
«. 3-3 

3 *»-*■ 

£1-5 
§ 2-6 
g 3-1 
a 4-2 
3 1-3 
1/3 2-4 

3- 5 

4- 6 



ABCDEFGHIJKLMNOPQRSTUVWXY Z 



I J p 




D 






Q G 


c 


E 








K 0 


R Z 




H V N 












G 




u 






W 


E D 


M L X 


E 




M 


X 




G 


I 


D 


J 




N 




R 


A 0 






X 


0 


c 








D 


K 




A F 


Y Q 


V N 


B 




T W 


L 






R 




E 






N 


Y Q 


U A 


M 0 


I 




C 






D 












U V 


F R 


0 G 




R 








L 




P 




S 


D 




Z 


L P 


H 






u 


V 












E 


D M 


F 


Q J 










V W 


K 


0 


X 


Y 






M A 




B 






J 




X P 


0 












A F Y 


D 


N R 




Y 












B 


C 


G 






Q S 




2! 






_L 


0 












S U 


V W X 





Figure 65. 



e. There are more than sufficient data here to permit of the re- 
construction of a complete equivalent primary component, for example, the 
following: 



1 2 3 4 5 6 7 8 8 10 11 12 13 14 15 18 17 18 18 20 21 22 23 34 28 28 

ITKNPZHMWBQEULFCSJAXRGDVOY 

f. The subsequent steps in the actual decipherment of the text of 
either of the two messages are of considerable interest. Thus far the 
cryptanalyst has only the cipher component of the primary sliding com- 
ponents. The plain component may be identical with the cipher component 
and may progress in the same direction, or in the reverse direction; or, 
the two components may be different. If different, the plain component 
may be the normal sequence, direct or reversed; or it may be a different 
mixed sequence. Tests must be made to ascertain which of these various 
possibilities is true. 

g. (l) It will first be assumed that the primary plain component 
is the normal direct sequence. Applying the procedure outlined in 
par. 33 to the message with the shorter key (Message No. 1, to give the 
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most data per secondary alphabet) , an attempt is made to solve the mes- 
sage. It is unnecessary here to go further into detail in this pro- 
cedure, suffice it to indicate that the attempt is unsuccessful and it 
follows that the plain component is not the normal direct sequence. A 
normal reversed sequence is then assumed for the plain component and 
the proper procedure applied. Again the attempt is found useless. Next, 
it is assumed that the plain component is identical with the cipher com- 
ponent, and the procedure outlined in par. 54 is tried. This also is 
unsuccessful. Another attempt, assuming the plain component runs in the 
reverse direction, is likewise unsuccessful. There remains one last 
hypothesis, viz., that the two primary components are different mixed 
sequences . 

(2) Below is given Message No. 1 transcribed in periods of four 
letters. Uniliteral frequency distributions for the four secondary al- 
phabets are shown below in Fig. 66a, labeled la, 2a, 3&> and 4a. These 
distributions are based upon the normal sequence A to Z. But since the 
reconstructed cipher component is at hand, these distributions can be 
rearranged according to the sequence of the cipher component, as shown 
in distributions labeled lb, 2b, 3b, and 4b in Fig. 66b. The latter dis- 
tributions may be combined~~by shifting distributions 2b, 3b, and 4b to 
proper super impositions with respect to lb so as to yield a single mono- 
alphabetic distribution for the entire message. In other wonll, the poly- 
alphabetic message can be converted into monoalphabetic terms, thus very 
considerably simplifying the solution . 



Message No. 1 



V 


M 


Y 


Z 


G E A U 


N T P K 


F A Y J 


I 


Z 


M 


B 


U 


M 


Y 


K 


B 


V 


F 


I 


V 


V 


S 


£ 


OAFS 


K X K R 


YWCA 


C 


Z 


0 


R 


D 


0 


Z 


R 


D 


E 


F 


B 


L 


K 


F 


E 


S M K S 


F A F E 


K V Q U 


R 


c 


M 


Y 


Z 


V 


0 


X 


V 


A 


B 


T 


A 


Y 


Y 


U 


0 A Y T 


D K F E 


N W N T 


D 


B 


Q 


K 


U 


L 


A 


J 


L 


Z 


I 


0 


U 


M 


A 


B 


OAFS 


KXQF 


U Y M J 


P 


W 


Q 


T 


D 


B 


T 


0 


S 


I 


Y 


s 


M 


I 


Y 


K 


U R 0 G 


M W C T 


M Z Z V 


M 


V 


A 


J 
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4b. ITKNPZHMWBQEULFCSJ AXRGDVOY 

Figure 66a. 

(3) Note in Fig. 66b how the four distributions are shifted for 
superimposition and how the combined distribution presents the character- 
istics of a typical monoalphabetic distribution. 

- — = - Jl m sr _ a M S — 

lb. ITKNPZHMWBQEULFCSJAXRGDVOY 

as — — £ = - £_ = i=_= = = = 

2b. EULFCSJAXRGDVOYITKNPZHMWBQ 

" - ?- « <i 

3b. KHPZHMWBQEULFCSJAXRGDVOYIT 

5 Ss Si e b <= 

4b. PZHMWBQEULFCSJAXRGDVOYITKN 



lb. -4b. a N g 5 ^ a | | ^ s I N — g g g jg 

combined ITKtiPZHMWBQEULFCSJAXRGDVOY 

Figure 66b. 
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(4) The letters belonging to Alphabets 2, 3* and 4 of the message 
may now be transcribed in terms of Alphabet 1. That is, the two S’s of 
Alphabet 2 become I*s; the L of Alphabet 2 becomes a K; the C becomes a 
P, and so on. Likewise, the two K’s of Alphabet 3 become I's, the N 
becomes a T, and so on. The entire message is then a monoalphabet and 
can readily be solved. It Is as follows: 



V D V T G 
ENEMY 

F M 0 M U 
U R T R 0 

S D I U F 
A N R 0 U 

V V D J U 
E I N F 0 

K W W I U 
FSSHO 

L V M R N 
D E R I C 



I S W N S K 

H A S C A P 

U K W I S Y 

0 P S H A V 

HUMKU W 
R 0 R P 0 S 

M N V T V D 

R C E M E N 

F Z L P V W 

U L D B E S 

X M U S L 

KROAD 



0 F M V L I R 

T U R E D H I 

V L F C R D S 

E D U G I N A 

VRPZ G Z U 

S I B L Y L 0 

0 W 0 U K3L 

T S T 0 PAD 

V D 0 Y R S C 

E N T V I A G 



Z Z U D V 0 

L L 0 N E T 

D L N S D I 

N D C A N H 

DC V M M V 

N G E R R E 

L R 0 R U D 

D I T I 0 N 

V U M C V 0 

E 0 R G E T 



B U U D V U 
W 0 0 N E 0 

U Z L J U M 
0 L D F 0 R 

A F V W 0 M 
Q U E S T R 

S Z 0 M U U 
A L T R 0 0 

U B D J M V 
0 W N F R E 



(^) Having the plain text, the derivation of the plain component 
(an equivalent) is an easy matter. It is merely necessary to base the 
reconstruction upon any of the secondary alphabets, since the plaintext 
ciphertext relationship is now known directly, and the primary cipher 
component is at hand. The primary plain component is found to be as 
follows: 



1 3 3 4 S 6 7 8 « 10 11 12 13 14 IS 16 17 18 19 30 21 22 23 24 28 26 

HMPCBL. RSV. . ODUGAFQKIYNETV 

(6) The key words for both messages can now be found, if desirable, 
by finding the equivalent of Ap in each of the secondary alphabets of the 
original polyalphabe tic messages. The key word for No. 1 is STAR; that 
for No. 2 is OCEANS. 



(7) The student may, if he wishes, try to find out whether the 
primary components reconstructed above are the original components or are 
equivalent components , by examining all the possible decimations of the 
two conqsonents for evidence of derivation from key words. 

h. As already treated in par. 37, the "Xtest may be brought to bear 
in the process of matching distributions to ascertain proper super imposi- 
tions for monoalphabeticity. In the case Just considered there were suf- 
ficient data in the distributions to permit the process to be applied 
successfully by eye, without necessitating statistical tests. Where, 
however, the distributions contain relatively few tallies, the use of 
statistical methods is imperative. 
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1. This case is an excellent illustration of the application of the 
process of converting a polyalphabet ic cipher into monoalphabetic terms . 
Because it is a very valuable and important cryptanalytic ^ trick, " the 
student should study it most carefully in order to gain a good understanding 
of the principle upon vhich it is based and its significance in cryptanaly- 
sis. The conversion in the case under discussion vas possible because the 
sequence of letters forming the cipher component had been reconstructed and 
vas known, and therefore the uniliteral distributions for the respective 
secondary cipher alphabets could theoretically be shifted to correct super- 
impositions for monoalphabeticity. It also happened that there were suf- 
ficient data in the distributions to give proper indications for their rela- 
tive displacements. Therefore, the theoretical possibility in this case 
became an actuality. Without these two necessary conditions the superim- 
position and conversion cannot be accomplished. The student should always 
be on the lookout for situations in which this is possible. 



62. Solution of l8ologs involving different pairs of unknown primary 
components . — a. If each message of a pair of isologs has been enciphered 
with a different set of primary components, the repeating keys being of 
different lengths, there are two procedures available for attacking such a 
situation. The first procedure involves a modification of the principles 
demonstrated in par. 61; the second procedure involves an entirely different 
technique, one which effects a direct conversion of the text to monoalpha- 
betic terms. These two procedures will now be treated in the subparagraphs 
below. 

b. Given the following two cryptograms suspected of containing the 
same plain text enciphered by different sets of primary components and with 
key words of different lengths, solve the messages. 



Message No. 1 



B W X P S 


0 B Y I I 


U Y H L F 


K F S 0 P 


V G E Y W 


P B V X 


0 


U G J P B 


W D X U G 


H S W D H 


KEKEC 


U A Y K P 


N F S P D 


0 B B Y B 


INKFL 


W A B 0 X 


P J X U V 


W Q F X R 


W X Y W 


s 


SDYZQ 


Z H E T A 


J X X Z W 


X J R OS_ 


P D E E W 


0 JON 


K 


G 1 R X R 


WPYDK 


N T J W R 


E V B U R 


D L I S J 


BLOK 


K 


F 0 D £ V 


DIZQZ 


S H C T W 


D I E X Z 
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Message No. 2 



J 


fl 


L 


E 


J 


M 


w 


u 


A 


H 


J 


H 


u 


I 


V 


Y 


N 


C 


H 


C 


H 


L 


p 


K 


D 


E 


w 


Z 


J 


J 


J 


N 


A 


H 


B 


H 


z 


B 


I 


M 


T 


U 


B 


Q 


E 


F 


J 


A 


K 


M 


J 


V 


B 


E 


F 


X 


N 


C 


T 


L 


F 


A 


A 


K 


G 


K 


I 


A 


B 


G 


C 


V 


F 


N 


Y 


F 


W 


B 


I 


Q 


G 


E 


R 


S_ 


A 


T 


Z 


U 


S 


D 


S 


X 


B 


U 


D 


S 


H 


A 


W 


A 


Y 


X 


L 


J 


0 


C 


Q 


L 


E 


D 


H 


X 


G 


z 


L 


Z 


u 


H 


N 


B 


V 


T 


J 


S_ 


A 


T 


S 


U 


U 


C 


M 


I 


A 


K 


K 


J 


E 


M 


I 


Y 


D 


s 


K 


G 


B 


V 


T 


J 


Y 


C 


X 


Y 


L 


Z 


E 


C 


X 


L 


s 


U 


M 


V 


M 


N 


D 


0 


N 


F 


J 


Y 























c. Factoring discloses that Message No. 1 has a period of 4, and 
Message No. 2 a period of 5. The messages are superimposed on a width 
of the least common multiple (20), and a reconstruction matrix is made, 
following the method outlined in subpar. 61d. This matrix is shown below: 



Values Message No 1 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 




L J D 


V T Y 




F 




M 


H G 


2 A 


LVT 


S 


E 




U 


H X 


3 A M P R K 






J 




B L 


4 Q 






E 




G N 


S K J 


5 G 


E B 






A J 


D 


L V 0 


K F 




M E 






T C 


2 W 


J N Q 


T 


I 






S Z 


3 J F 


A 






L 




Z U 


4 U 


B KAY 




E 






S J 


5 M 


H C 


G 


J 




D 


Y 


L 


X 




M H 




S 


J C 


2 V X 


N 




Y 




I 


H 


3 F L G 


U A 










B 


4 Z 


E 


I 


N H 






K U 


5 B 


V 




F D K 




ELY 


L C J 


Y 




X Z F 






H S 


2 Z 


NEW 










E X 


3 M A 






H 




C 


£ L 


+ 






N H T S 




w 


1 


5 A L 


M B 




C 


x 




Q U 




Figure 67 . 

d. Since the pairs of components for the two messages are different, 
indirect symmetry will in this case not extend to the 0 line, so all chaining 
must be done within the matrix. Apparent conflicts in the matrix are noted, 
such as the A*s in lines 2-2 and 3-3, the rest of the letters in these lines 
not being identical as might at first be expected. However, if we restrict 
our treatment only to the homogeneous lines 1-1, 1-2, 1-3, 1-4, and 1-5 (see 
the matrix in Fig. 68, below), we will have data which may be interrelated 
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and which will produce an equivalent primary component , either from 
these data alone or facilitated hy another family of related rows of 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



1-1 


J 


D 


V T 


Y 


F 


M 


H G 


1-2 




Z N 


H 


W 






E X 


1-3 


F 


L G 


U 


A 






B 


1-4 




U B 


K A 


Y 


E 




S J 


1-5 


G 




E 


B 




A J 


D 



Figure 66. 



the matrix, such as 2-1, 2-2, ... 2-5. The equivalent primary component 
recovered will be that for Message No. 2, since it is the values for this 
message which are entered within the matrix and which are manipulated. 

By inverting the matrix so that the values for Message No. 1 are written 
within the matrix, a similar procedure will yield an equivalent primary 
component for the first message. 

e. An entirely different technique for treating these isologs will 
now be described. We have factored the two messages as periods of 4 and 
5; and now we write out the messages on the width of the least comnon 
multiple, retaining indications of the alphabets to which the cipher let- 
ters belong, thus: 
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1 


2 


3 


4 


1 


2 3 4 1 


2 


3 


4 12 


3 4 


1 


234 


B 


W 


X 


P 


s 


0 B Y I 


I 


U 


Y H L 


F K 


F 


SOP 


J 


H L 


E 


JMHUAI 


J 


H U I 


V Y H 


C H C 


1 


2 


3 


4 


5 


12 3 4 


5 


1 


2 3 4 


5 1 


2 


3 4 5 


1 


2 


3 4 


1 


2 3 4 1 


2 


3 4 12 


3 4 


1 


2 3 4 


V G E Y W 


P B V X 


0 U 


G J P B W 


D 


X U G 


H L 


P 


K 


D 


E W Z J J J 


N A H B H Z 


B I M 


1 


2 


3 


4 


5 


12 3 4 


5 


1 


2 3 4 


5 1 


2 


3 4 5 


1 


2 


3 


4 


1 


2 3 4 1 


2 


3 


412 3 4 


1 


2 3 4 


H S 


W 


D 


H K H K H 


C 


U 


A Y K 


P N 


F 


S P D 


T U 


B 


Q E 


FJAKMJVBE 


F X N 


C T L 


1 


2 


3 


4 


5 


12 3 4 


5 


1 


2 3 4 


5 1 


2 


3 4 5 


1 


2 


3 


4 


1 


2 3 4 1 


2 


3 


4 12 


3 4 


1 


2 3 4 


0 


B 


B 


Y B 


INKFL 


w 


ABO 


X P 


J 


X U V 


F 


A 


A K 


G 


K I A B 


G 


c 


V F N 


Y F W 


B I Q 


1 


2 


3 


4 


5 


12 3 4 


5 


1 


2 3 4 


5 1 


2 


3 4 5 
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No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



No. 1 
No. 2 



123^123^12 

WQFXRWXYWS 

GERSATZUSD 

123^5123^5 

123^123^12 

JXXZWXJROS 

YXLJDCQLED 

123^5123^5 



123^123^12 

SHCTWDIEXZ 

MVMNDONFJY 

123^5123^5 



3^123^1234 

SDYZQZHETA 

SXBUDSHAWA 

1234512345 

3 4 1 2 3 4 1 2 3 4 
PDEEWOJONK 
HXGZLZWHNB 
1 2 3 4 5 1 2 3 4 5 



1234123412341234X234 

GIRXRVUYDKNTJWREVBUR 

VTJSATSUUCMIAKKJEMIY 

1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 

12341234123412341234 
DLISJBLCKKFODEVDYZQZ 
DSKGBVTJYCXYLZECXLSU 
1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 



f. Let us arbitrarily assign the value of Ap to the first letter 
of the plain text. Since then, in Message No. 1, B c ■ An of Alphabet 1, 
every B c in Alphabet 1 must equal Apj these values are entered on the 
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work sheet. How since the 63 th and 73d cipher letters of Message No. 1 are 

5 

Ap, this establishes that the 65 th and 73d letters of Message Ho. 2 (G c and 

3 

Fc) are also A p j therefore, these latter values are entered throughout the 
work sheet where they occur. Similarly, since every J c of Alphabet 1 in 
Message Ho. 2 equals Ap, this value is entered on the work sheet under every 
occurrence of J c . By continuing this process, all the Ap's of the pseudo- 
plain text shall have been recovered, and the work sheet will now look as 
shown in Fig. 69 , below: 



Ho. 1 
Ho. 2 



Ho. 1 
Ho. 2 



Ho. 1 
Ho. 2 



No. 1 
Ho. 2 



No. 1 
No. 2 



No. 1 
No. 2 



Ho. 1 
Ho. 2 



Ho. 1 
Ho. 2 



Ho. 1 
No. 2 
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123^123^123^123^123^ 

BWXPSOBYIIUYHLFKFSOP 

JHLEJMWUAHJHUIVYNCHC 

123451234512345123^5 

A A A 

12341234123412341234 

VGEYWPBVXOUGJPBWDXUG 

HLPKDEWZJJJNAHBHZBIM 

12345123451234512345 

A A 

12341234123412341234 

HSWDHKHKHCUAYKPNFSPD 

TUBQEFJAKMJVBEFXNCTL 

12345123451234512345 

A 

12341234123412341234 
OBBYBINKFLWABOXPJXUV 
FAAKGKIABGCVFNYFWBIQ 
12345123451234512345 
A A A A 

12341234123412341234 
WQFXRWXYWSSDYZQZHETA 
GERSATZUSDSXBUDSHAWA 
12345123451234512345 

12341234123412341234 
JXXZWXJROSFDEEWOJONK 
YXLJDC QLEDHXGZLZWHHB 
12345123451234512345 

12341234123412341234 

GIRXRWUYDKNTJWREVBUR 

VTJSATSUUCMIAKKJEMIY 

12345123451234512345 

A A A 

12341234123412341234 
DLISJBLCKKFODEVDYZQZ 
DSKGBVTJYCXYLZECXLSU 

12345123451234512345 

A 

1234123412 

SHCTWDIEXZ 

MVMNDONFJY 

1234512345 

A 

Figure 69 . 
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g. We will now arbitrarily assign the value Bp to the V c at the 21st 

2 

position of Message No. 1; the other V c of Message No. 1 establishes the Ec 
of Message No. 2 also as Bp. This procedure is continued, until all the Bp's 
in the pseudo-plain text are recovered. Continuing in this vein, assigning 
arbitrary plaintext values to all the cipher letters of Alphabet 1 of Message 
No. 1, we are able to reduce almost the entire text 3 to monoalphabetlc terms. 
The work sheet will now look as follows: 



123^123^123 1123^123^ 
No. 1 BWXPSOBYIIUYHLFKFSOP 
No. 2 JHLEJMWUAHJHUIVYNCHC 
123^512345123^5123^5 
ACHDIIFCK ACCA FME D 
12 3 VT 2 ~3 ^123412341234 
No. 1 VGEYWPBVXOUGJPBWDXUG 
No. 2 HLPKDEWZJJJNAHBHZBIM 
12345123451234512345 
B CE F LIAMF FBHOAM 
12341234123412341234 
No. 1 HSWDHKHKHCUAYKPNFSPD 
No. 2 TUBQEFJAKMJVBEFXNCTL 
12345123451234512345 

CEOOCD FCMAJODB MEBO 
12341234123412341234 
No. 1 OBBYBINKFLWABOXPJXUV 
No. 2 FAAKGKIABGCVFNYFWBIQ 
12345123451234512345 
DGFCA I F M A 0 J A I H D F 0 A 
12341234123412341234 
No. 1 WQFXRWXYWSSDYZQZHETA 
No. 2 GERSATZUSDSXBUDSHAWA 
12345123451234512345 
EB EJCHCEELOOHELCF J 
12341234123412341234 
No. 1 JXXZWXJROSPDEEWOJONK 
No. 2 YXLJDC QLEDHXGZLZWHNB 
12345123451234512345 
FOHLEO HDEBOPFO FIIF 
12341234123412341234 
No. 1 GIRXRWUYDKNTJWREVBUR 
No. 2 VTJSATSUUCM1AKKJEMIY 
12345123451234512345 

G EJCACHDI I_F C ABGAH 

1 2 3 4 1 2 3TT5TV l ”2 3 4 1 2 3 4 

No. 1 DLISJBLCKKFODEVDYZQZ 
No. 2 DSKGBVTJYCXYLZECXLSU 
12345123451234512345 

HAM FG NO HFCOOHEL 
1234123412 
No. 1 SHCTWDIEXZ 
No. 2 MVMNDONFJY 
1234512345 
IJGIE ,M A L H 



3 



Actually in this particular case the reduction is 85$ complete 
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Note the idiomorphic repetition (representing the word art tt.tjtr y) j pre- 
viously latent, which now becomes patent in the reduction process. 

h. At this point, sequence reconstruction matrices may be made of 
the two messages, the <f> line representing the pseudo-plain text and the 
values inside the matrix being the cipher text, ftiese matrices are illus- 
trated in Figs. 70a and b, below: 

0 
1 
2 
3 
k 



1 

2 

3 

k 

5 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



B 


V 


H 


0 


W 


J 


G 


D 


S 


R 


I X 


F K Y E 1 


L 


Q 


tf 


K 


S 


E 


B 


Z 


0 


H 




C 


X 


U 


P 


V 




Q 


B 


C 


X 


N 




S 


I 


w 


E 


w 


Y 


P 


X 


K 




R 


0 


A 


z 


G 


D 






















Figure 


70 a. 


A 


_B 


_C_ 


_D 


_E 


_F 


G_ 


H 


_I 


J_ 


K L 


MNOPQRSTUVWXYZ 



JHTFGYVDM S C 
SEH UWAZIV N X 



F U CAMLH K BG 

ITKESZ UN AJBYQ 

G F E C D B Y J A U M L 



Figure 70b. 

From these matrices, it is a simple matter to chain out the equivalent 
primary cipher components used for each message. Having reconstructed 
the cipher component for a message, the alphabets may be aligned and now 
the entire text converted to monoalphabet ic terms. After solution of the 
messages, it is found that Message No. 1 is a case of direct synmetry 
with the cipher component being based on the key word HYDRAULIC, and Message 
No. 2 is a case of indirect synmetry with both components being keyvord- 
mixed sequences based on QUESTIONABLY. 

i. The method described in subpars. 62e to h, above, involves tech- 
niques' which have a broad application in cryptanalytics , in other fields 
besides the solution of periodic polyalphabetic cryptograms. But even in 
this latter field, it is the only approach to solution where the cryptosys- 
tem involves non-related, random-mixed secondary alphabets among which no 
symmetry of any sort exists. 

The two messages used in the example had periods prime to each 
other. If this had not been the case, only a slight modification of either 
of the two methods would have been necessary. For the student who cares to 
investigate this matter further, there is given in Fig. 71, below, a new 
Message No. 2 to be paired with Message No. 1 in subpar. 62b; he can then 
solve this pair of isologs by either of the two methods demonstrated in 
this paragraph. 
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— a. It happens occasionally that the cryptanalyst has two messages with 
identical beginnings, but after a few letters the cipher texts diverge; 
and the group counts of the two messages are either identical or nearly 
Identical. Mils situation could arise in a pair of isoiogs, when the first 
message has a letter omitted (or added) at the point of divergence, and 
the second message (with the identical beginning) has this error corrected. 
In other words, we have a pair of true isologs except for the deletion (or 
addition) of a single letter. Such a situation is called a "stagger". 4 
By treating the Isologous portions of the two messages, we may recover the 
primary cipher component by the process of indirect symmetry. This is best 
illustrated by an example. 

b. Let us suppose the following two messages are at hand: 

Message "A" 

KOIPQ IHGIS PQOK D MPVKS IKE QV SKPUS 

EPPSF KP EEE P YVXB PISW Y ET DQS PIMXK 

HGFTJ GOGJT XIEQE HPGCG OEOBE IEI EW 

J E E E P UUMDK AQVOL MB 

Message ”B" 

KOIPQ IHGIS PQOK P STIHN ENHQP QEQIM 

CUDTB XRV MF QI EQL RIYCC FFO WP GDOTG 

RPUVO COSUG OGGUT FLIOO UUQNK U F F 0 Q 

UT MFQ I BYAS HSPQB CTV 

4 Such errors are more prone to happen in machine cipher systems when the addition or deletion of a 
word separator in a pair of otherwise identical cryptograms (enciphered with identical initial settings or keys) 
causes a "stagger" Sometimes the stagger may be progressive, 1 e , the interval of the displacement be- 
coming greater and greater as additional wotd separators are omitted 
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We note the Identical l4-letter beginnings; ve also note that Message "B" 

Is one letter longer than Message "A", and that the trigraphic and tetra- 
graphlc repetitions In Message "B" are spaced Identically as in Message "A" 
except for the fact that their position in the cipher text is one letter 
more than their counterparts in Message "A”. Both messages factor to 6 
alphabets. 

c. These phenomena clearly point to a case of a stagger, with Mes- 
sage 1 %” containing one more letter than Message ''A”. If this is the case, 
and the plain texts are otherwise identical, then the P c in the 15th posi- 
tion of Message "B" seems to be the extra letter, coming as it does after 
the identical beginning. The two texts are now super imposed, and the equiv 
aleneles are inserted into a sequence reconstruction matrix, as is shown 
below: 



3456123 ^ 56123456123456123456123^5612345612345612 
"A" DMP'VKSYKEQVBKPUSEPPSFKPEEEPYVXBPISWYETDQBPIMXKHG 
"B" STIHHEMQPQEQIMCUDTBXRVMFQIEQytlYCCFFOWPGKXDGRPU 
456123456123456123456123456123456123456123456123 

345612345612345612345612345612345612345612345 
"A" FTJG0GJTXIEQEHPG0G0E0BEYETSWJEEEPUUMDKAQV0U1B 
"B" V0C0SUG0GGUTFLI00UUQHKOTT0QSJTMFQIBYASB5PQBCT7 
456123456123456123456123456123456123456123456 



ABCDEFGHIJKLMNOPQ. RSTUVWXYZ 



1-2 


0 U 




P TH 




S V 


G YQC 




2-3 


M 


U 




A 


B D T 


E 


L F 


3-4 


R SFV 




0 G Q C 




U T 




N 


4-5 


Q 




L H 


T 


I 


B 0 




5-6 


S V W Q X 




Y C 




N I 


M 


G 


6-1 


K 


_0 


G R 




P 


C B H U 


E 



The solution, which proceeds in the usual manner, is left as an exercise 
for the interested student. 5 



5 Note, m matrices of this kind, how easy it is to align properly the cipher components after the 
primary cipher component (or an equivalent) has been recovered, thereby expediting the reduction 
of the cipher text to monoalphabetic terms. From the data m the sequence reconstruction matrix, 
it is observed that the U c of Alphabet 2 is under die E c of Alphabet 1, the of Alphabet 3 is under 
the Ec of Alphabet 2, the F c of Alphabet 4 is under the E c of Alphabet 3, etc. . thus all the cipher 
components may be quickly put together at their proper relative displacements, revealing the re- 
peating key in the process m one of the columns. 
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64. Solution of a periodic cryptogram containing a long latent repe- 
tition.— a. It sometimes happens that a periodic cryptogram contains a 
long passage repeated in its plain text, the second occurrence of vhich is 
enciphered at a cyclical offset from the first occurrence. 3he recognition 
and delineation of the latent repetition may be made possible by the spatial 
relationships of ciphertext repetitions present within the message. 6 If 
such a latent repetition is found, and it is long enough, the equivalencies 
from the tvo corresponding sequences may be chained together to yield an 
equivalent primary cipher component, and thus by-pass a more laborious pro- 
cess of solution by the usual method of frequency analysis or making as- 
sumptions in the plain text of a polyalphabetic cipher. 

b. As an example, let us suppose the following message has been in- 
tercepted: 

ASEXZ LRCWC HXRUG LXAXW I NYEH PJRDI ( 



RDXWM LAIEK KTAGZ FZNCE LLTFW C RBJI f 



.ZLCVH 


HAAJR 


D X R T F 


M T V J H 
IBLFP 


P G V P 


I 


M W Y R L 


R R B J T 


Z1CVH 


D K J T A 


A W N Y 


E 


HPEHG 


F I R V A 


R X V J F 


J A H D F 


IVVTN 


A E Z A 


Z 


J X V L Y ( 


P J T N Q 


A B K X D 


J X H A X 


Y W P I M 


I C G A 


H 


I W E F G k 


( W M I Z J 


H V I X V 


L Y P G A 


Y X Z M E 


K L I S 


B 


0 T F 0 M 


V W E F G 


W M I Z J 


D Z A C G 


J V M P V 


N D K G 


K 


V M A I B _ 



4 LFPAW HYEHP 



An examination of the cipher text, which factors to a period of 7, reveals 
the following striking sets of repetitions with identical spatial relation- 
ships of the repetitions (beginning at positions 27 and 147 in the cipher 
text) in the two sets: 

Set "A": JRDXR. . (25) • .RBJTZLCVH. . (3) • . JRDXR. . (18) . .RBJTZLCVH 

Set "B": XVLYP..(25)..WEFGWMIZJ..(3)..XVLYP..(l8)..WEFGWMIZJ 

This phenomenon could arise from a repetition of a long section of plain 
text within the message. The presence of the repetitions at the beginning 



6 It is also possible that, because of highly stereotyped and redundant plain text of a particular message, 
there might be two sets of long polygraphic repetitions of the same length in the cipher text. If these sets 
actually represent the same plain text, they may be chained together as described below to derive a partial 
or even complete equivalent primary cipher component. 
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and end of these sets of sequences delineates the limits , Insofar dis- 
cernible, of the repeated plaintext passage. Since these two sets are 
equivalent to each other, it is possible to superimpose these sections 
and distribute the equivalencies into a sequence reconstruction matrix, 
from which an equivalent primary component may be chained, following a 
procedure similar to that outlined in subpar. 63c_. The completion of the 
solution of this problem, too, is left as an exercise for the student. 

65. Solution by superimposition. —a. In solving an ordinary repeating- 
key cipher the first step, that of ascertaining the length of the period, is 
of no significance in itself. It merely paves the way for and makes possible 
the second step, which consists in allocating the letters of the cryptogram 
into Individual monoalphabetlc distributions. The third step then consists 
in solving these distributions. Usually, the text of the message is tran- 
scribed into its periods and is written out in successive lines corresponding 
in length with that of the period. The diagram then consists of a series of 
columns of letters, and the letters in each column belong to the same mono- 
alphabet. Another way of looking at the matter is to conceive of the text 
as having thus been transcribed into superimposed periods; in such a case 
the letters in each column have undergone the same kind of treatment by the 
same elements (plain and cipher components of the cipher alphabet) . 7 

b. Suppose, however, that the repetitive key is very long and that 
the message is short, so that there axe only a very few, if any, complete 
cycles in the text. Then the solution of the message becomes difficult, if 
not impossible (unless the alphabets are known), because there is not a suf- 
ficient number of superimposable periods to yield monoalphabetlc distribu- 
tions which can be solved by frequency principles. But suppose also that 
there are many short cryptograms all enciphered by the same key, each message 
beginning at identical starting points in the key. Then it is clear that if 
these messages are superimposed "head on" or "in flush depth", (l) the let- 
ters in the respective columns will all belong to individual alphabets, and 
(2) if there is a sufficient number of such superimposable messages (say 
25-30, for English), then the frequency distributions applicable to the 
successive columns of text can be solved- -without knowing the length of 

the key . 8 In other words, any difficulties that may have arisen on account 
of failure or inability to ascertain the length of the period have been 
circumvented. The second step in normal solution is thus by-passed. 

c. Furthermore, and this is a very important point, even if an ex- 
tremely long key is employed and a series of messages beginning at different 
initial points are enciphered by such a key, this method of solution by 
superimposition can be employed, provided the messages can be superimposed 
correctly, that is, so that the letters which fall in one column really be- 
long to one cipher alphabet. Just how this can be done will be treated in 
Chapters IX and XIV. 

7 In operational parlance, the superimposed periods ate said to be "m depth”. 

3 The assumption of probable initial words of messages and stereotyped beginnings is a powerful method 
of attack in such situations. 
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66. Additional remarks.— a. We have seen in pars. 60-64 that the 
chaining process between ciphertexts applies to the latent characteris- 
tics of the cipher components, regardless of the identity of the plain 
components and regardless whether direct or indirect symmetry is involved 
in the cryptosystems. 

b. The observant student will have noted that a large part of the 
text thus far is devoted to the elucidation and application of a very few 
basic principles. These principles are, however, extremely important and 
their proper usage in the hands of a skilled cryptanalyst makes them practi- 
cally indispensable tools of his art. The student should therefore drill 
himself in the application of these tools by practicing upon problem after 
problem, until he acquires facility in their use and feels competent to 
apply them in practice whenever the least opportunity presents Itself. 

This will save him much time and effort in the solution of bona fide mes- 
sages. 
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CHAPTER IX 

PROGRESSIVE ALPHABET STSTEMS 



Paragraph 



Preliminary remarks 67 

Solution of a progressive alphabet cipher when the cipher alphabets are known 68 

Solution by a method involving the Tftest 69 

Solution by the probable word method 70 

Solution by means of isomorphs 7 1 

Solution by supenmposmon 72 

Additional remarks 73 



67. Pr«3 i»in«T-v In progressive alphabet systems the 

basic principle is quite simple. Two primary components are arranged or 
provided for according to a key which may be varied from time to time; 
the interaction of the primary components results in making available for 
cryptographic purposes a set of cipher alphabets; all the latter are em- 
ployed in a fixed sequence or progression; hence the designation progres- 
sive alphabet system. Since the number of alphabets available for such use 
is rather small (usually 2b), if the text to be enciphered is much longer 
than the sequence of alphabets, then the system reduces to a periodic 
method. But if the number of alphabets is large as compared with the text 
to be enciphered, 1 so that the sequence of alphabets is not repeated, then, 
of course, the cryptographic text will exhibit no periodic phenomena. 

b. The series of cipher alphabets in such a system constitutes a 
keying sequence. Once set up, often the only remaining element in the key 
for a specific message is the starting point in the sequence, that is, the 
initial cipher alphabet employed in enciphering a given message. If this 
keying sequence must be employed by a large group of correspondents, and 
if all messages employ the same starting point in the keying sequence, ob- 
viously the cryptograms may simply be superimposed without any preliminary 
testing to ascertain proper points for superimposition. It has already 
been indicated (cf. par. 65) how cases of this sort may be solved. However, 
if messages are enciphered with varying starting points, the matter of 
superimposing them properly takes on a different aspect. This matter will 
be treated in par. 72. 

66. Solution of a progressive alphabet cipher when the cipher alpha- 
bets are known. — a~ The simplest case of a progressive alphabet system 
involves two interacting primary components which slide against each other 
to produce a set of 26 secondary alphabets, which are employed one after 
the other consecutively in the simplest type of progression. Beginning at 



1 For instance if die cipher component of a disc cipher device were composed of 100 dinomes and no 
message were longer than 100 letters, no periodicity would be manifested 
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an initial juxtaposition, producing say, Alphabet 1, the subsequent second- 
ary alphabets are in the sequence 2, 3, ... 26, 1, 2, 3, ...» and so on. 

If a different initial juxtaposition is used, say Alphabet 10 is the first 
one, the sequence is exactly the sane as before, only beginning at a differ- 
ent point. 

b. Suppose that the two primary components are baaed upon the key word 



HYDRAULIC. A message 


is 


to 


he enciphered, 


beginning with 


Alphabet 1. 


Thus 


Plain component: 


: H Y 


D R A 


U L I 


C B E 


F 0 J 


K M H 


0 P Q 


S T V 


W X Z 




Cipher component: H T 


D R A 


U L I 


C B E 


F G J 


K M H 


0 P Q 


S T V 


W X Z 


H Y D 


Letter Ho: 1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


Alphabet Ho: 1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


Plain text: E 


H 


E 


M 


Y 


H 


A 


S 


P 


L 


A 


C 


E 


D 


H 


E 


A 


V 


Y 


I 


Cipher text : E 


0 


0 


P 


U 


U 


E 


Y 


H 


M 


K 


Q 


V 


H 


K 


Z 


S 


J 


Q 


H 


Letter Ho: 21 


22 


23 


2k 


25 


26 


27 


28 


29 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


Alphabet Ho: 21 


22 


23 


2k 


25 


26 


1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


Plain text : H 


T 


E 


R 


D 


I 


C 


T 


I 


0 


H 


F 


I 


R 


E 


U 


P 


0 


H 


z 


Cipher text : E 


H 


L 


H 


H 


L 


C 


V 


B 


s 


S 


H 


J 


E 


P 


K 


D 


D 


D 


G 


Letter Ho: 4l 


42 


*3 


kb 


45 


46 


47 


48 


49 


50 


51 


52 


53 
















Alphabet Ho: 15 


16 


17 


18 


19 


20 


21 


22 


23 


24 


25 


26 


1 
















Plain text : A 


H 


E 


S 


V 


I 


L 


L 


E 


R 


0 


A 


D 
















Cipher text: P 


U 


H 


F 


K 


H 


H 


Y 


L 


H 


M 


R 


D 

















c. This method reduces to a periodic system Involving 26 secondary 
elpher alphabets and the latter are used in simple progression. It is 
obvious therefore that the 1 st, 27 th, 53 d, ... letters are in the 1 st 
alphabet; the 2 d, 2 dth, 54th, ... letters are in the 2 d alphabet, and so 
on. 



d. To solve such a cryptogram, knowing the two primary components , 
is hardly a problem at all. The only element lacking is a knowledge of 
the starting point. But this is not necessary, for merely by completing 
the plain-component sequence and examining the diagonals of the diagram, 
the plain text becomes evident. For example, let us consider that the 
first two groups of an intercepted message are HIDCT EHUXI. . . , and let us 
assume that the components are keyword-mixed sequences based upon HYDRAULIC. 
Completing the plain-component sequences inltltated by the successive cipher 
letters, the plain text EHEMY MACHI ... is seen to come out in successive 
steps upward in Fig. 72. Had the cipher component been shifted in the 
opposite direction in encipherment, the steps would have beerf downward 
instead of upward. If the sliding strips had been set up according to 
the sequence of cipher letters hut on a diagonal, then, of course, the 
plaintext letters would have reappeared on one generatrix. 
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Figure 72. 

e. If the components were two different known mixed sequences, it 
vould~of course first be necessary to convert the cipher letters into their 
plain-component equivalents before completing the plain-component sequences. 
In any case, faced with an unknown type of progressive alphabet cipher, 
completing the plain -component sequences on the hypothesis of direct or 
reversed standard alphabets is the logical thing to do, and will quickly 
prove or disprove these hypotheses. If the primary components are not 
known sequences , the methods given in this paragraph obviously cannot apply; 
fortunately, however, there exist several methods which can be used in such 
situations , as will be treated in the succeeding paragraphs. 

b9. Solution by a method involving the "X. test. — a. An interesting 
general solution of a statistical nature of a progressive alphabet system 
will now be discussed. The problem involves secondary alphabets derived 
from the interaction of two identical mixed primary components. It will 
be assumed that the enemy has been using a system of this kind and that the 
primary components are changed daily. 



b. Before attacking an actual problem of this type, suppose a few 
minutes be devoted to a general analysis of its elements. It is here 
assumed that the primary components are based upon the HXDRAULIC. . . .Z 
sequence and that the cipher component is shifted toward the right one step 
at a time. Consider a cipher square such as that shown in Fig. 73 , which 
is applicable to the type of problem under study. It has been arranged in 
the form of a deciphering square. In this square, the horizontal sequences 
are all identical but merely shifted relatively; the letters inside the 
square are plaintext letters . 
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Alphabet Ho. 

) 2 3 4 6 0 7 8 2 10 11 12 13 14 18 10 17 18 1# 20 21 22 23 24 25 20 

AULICBEFGJKMHOPQSTVWXZHYDR 
BEFGJKMHOPQSTVWXZHYDRAULIC 
CBEFGJKMHOPQSTVWXZHYDRAULI 
DRAULICBEFGJKMHOPQSTVWXZHY 
EFGJKMHOPQS TVWXZHYDRAULICB 
FGJKMHOPQSTVWXZHYDRAULICBE 
GJKHNOPQSTVWXZHYDRAULICBEF 
HYDBAULICBEFG JKMSOPQS TVVXZ 
ICBEFGJKMHOPQSTVWXZHYDRAUL 
JKMNOPQSTVVXZHYDRAULICBEFG 
KMNOPQSTVWXZHYDRAULICBEFGJ 
LICBEFGJKMHOPQSTVWXZHYDRAU 
MHOPQSTVWXZHYDRAULICBEFGJK 
HOPQSTVWXZHYDRAULICBEFGJKM 
OPQSTVWXZHYDRAULICBEFGJKMH 
PQSTVWXZHYDRAULICBEFGJKHHO 
QSTVWXZHYDRAULICBEFGJKMHOP 
RAULICBEFGJKMNOPQSTVWXZHYB 
STVWXZHYDRAULICBEFGJKMHOPQ 
TVWXZHYDRAULICBEFGJKMNOPQS 
ULICBEFGJKMHOPQS TVWXZHYDRA 
VWXZHYDRAULICBEFGJKMHOPQST 
WXZHYDRAULICBEFGJKMNOPQSTV 
XZHYDRAULICBEFGJKMHOPQSTVW 
YDRAULICBEFGJKMROPQSTVWXZH 
ZHYDRAULICBEFGJKMHOPQSTVHX 

(Plaintext letters are vlthin the square proper) 

Figure 73 • 



c. If, for mere purposes of demons tr at Ion, Instead of letters vlthin 
the cells of the square there are placed tallies corresponding In number 
with the normal frequencies of the letters occupying the respective cells, 
the cipher square becomes as follows (shoving only the first three rows of 
the square): 

1 2 3 4 5 67 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 




Figure 74a. 
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d. It is obvious that here is a case wherein if two distributions 
pertaining to the square are Isolated from the square, the % test can be 
applied to ascertain how the distributions should be shifted relative to 
each other so that they can be superimposed and made to yield a monoalpha* 
betlc composite. There is clearly only one correct superimposition out of 
25 possibilities. In this case, the "B" row of tallies must be displaced 
5 intervals to the right in order to match it and amalgamate it with the 
"A" row of tallies. Thus : 




t u I jl a 

22 23 24 25 26 



-8 

6 7 



A 




* i 

16 17 18 



Jl? 




S ? 

25 26 



.5 16 17 18 19 20 



S 2 ? 



Figure 74b . 



e. Note that the amount of displacement, that is, the number of inter- 
vals the "B" sequence must be shifted to make it match the "A" sequence in 
Fig. 74b, corresponds exactly to the distance between the letters A and B in 

0 1 2 3 4 5 

the primary cipher component, which is 5 intervals. Thus: ... AULICB ... 
The fact that the primary plain component is in this case identical with the 
primary cipher component has nothing to do with the matter. The displace- 
ment interval is being measured on the cipher component . It is important 
that the student see this point very clearly. Be can, if he like, prove the 
point by experimenting with two different primary components. 

f . Assuming that a message in such a system is to be solved, the text 
is transcribed in rows of 26 letters. A uniliteral frequency distribution 
is made for each column of the transcribed text, the 26 separate distribu- 
tions being compiled within a single square such as that shown in Fig. 75. 
Such a square may be termed a frequency distribution square . 

g. Now the vertical columns of tallies within such a distribution 

square constitute frequency distributions of the usual type: They show the 

distribution of the various cipher letters in each cipher alphabet. If 
there were many lines of text, all arranged in periods of 26 letters, then 
each column of the frequency square could be solved in the usual manner, by 
the application of the simple principles of monoalphabetic frequency. But 
what do the horizontal rows of tallies within the square represent? Is it 
not clear that the first such row, the "A" row, merely shows the distribu- 
tion of Ac throughout the successive cipher alphabets? And does not this 
graphic picture of the distribution of Ac correspond to the sequence of let- 



ters compel nff the primary plain component? Furthermore, is it not clear that 
what has been said of the "A * 1 row Of tallies applies equally to the B, C, D, 
... Z rows? Finally, is it not clear that the graphic pictures of all the 
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distributions correspond to the same sequence of letters, except that the 
sequence begins with a different letter in each row? In other words, all 
the horizontal rows of tallies within the distribution square apply to the 
same sequence of plaintext letters , the sequences in one row merely begin- 
ning with a different letter from that with which another row begins* The 
sequences of letters to which the tallies apply in the various rows are 
merely displaced relative to one another* Now if there are sufficient data 
for statistical purposes in the various horizontal sequences of tallies 
within the distribution square, these sequences, being approximately similar 
can be studied by means of the Xtest to find their relative displacements * 
And in finding the latter, a method is provided whereby the primary cipher 
component may be reconstructed, since the correct assembling of the dis- 
placement data will yield the sequence of letters constituting the primary 
cipher component. If the plain component is identical with the cipher com- 
ponent, the solution is laaediately at hand; if the components are different 
the solution is but one step removed. Thus , there has been elaborated a 
method of solving this type of cipher system without making any assumptions 
of values for cipher letters. 



h. We will now take up a typical problem, employing the procedures 
just discussed. The following cryptogram has been enciphered according to 
the method indicated, by progressive, simple, uninterrupted shifting of a 
primary cipher component against an identical primary plain component. 
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Cryptogram 



VGJJH 
BUFRV 
W C K 0 0 
W F K G Y 
R P W T M 
C K B I W 
QHGKT 

V C X u c 
U A H Y H 
L W Y J G 
BHEEA 
W B R Q N 
W L X G S 
BKHUH 
M F G J X 
AABVH 
HZKFE 
E B Y B M 
J 0 U A H 
IHNDF 
W T J Y Q 

V V P W A 

ovuss 

THKHF 
3DEVQ 
U S E S K 
EEJIR 
H P V V V 
X A Z 0 W 
W Z E Y L 
LVILP 
LCZBM 
R J I C T 
Q B C J M 
B P V T T 



M M J X E 
W W W Y 0 
F F F G E 
P B B X C 
GIXFT 
X M X U D 
I U X Y J 
J L M L L 
VLOCX 
T V P Q K 
M R C R 0 
FJVBR 
H Q W H P 

Y Y C I W 
EDGCO 
XIHOW 
X S R U Y 
L A B J V 
CUGZL 
R J F N B 
B Y R L I 
BUJK1 
GAMES 
U C V V s 
S I J P H 
DSBBK 
C Z B T B 

Y K J E F 
R R X Y K 
J E R 0 Q 
Q S E D Y 
S D J W Q 
UUDSK 
EBYST 
CQBVI 



BGCOC 
1EFJK 
P Q R Y Y 
H B F Y I 
E C J B 0 
I P F F U 
J A 0 W Z 

Y E K F F 
SDQVC 
PKTLH 

V S T X E 

V D 0 P U 
JBCHN 
D G S J C 
P T G P W 
H D E Q U 
Q I 0 V R 
T G F F G 
X I A J K 
H Q L X H 
TOOUS 
F P F Y W 
C W B S W 
S3PLQ 
Q J A V F 
R L V W R 
L X P J J 
H Q S X J 

Y G M G Z 
S 0 Q K 0 
IOEXO 
X T J Y L 
K W D V M 
S S J K S 
ZKEQD 



F T R P B 
OKHTT 
I W X M X 
E T X H F 
K V B U Q 

Y K V 3 3 

0 C F T R 
ZVQJQ 

Y V 3 I L 
SROOE 
SHPTB 
QRLKQ 
JQSOQ 
TGPGS 

Q Q V q I 

AISFX 
E R D J V 
X Y I V G 
W D V T Y 
M H Q Y Y 
R C D C V 

Y QZ QF 
MLR YQ 
UPCVV 
BIZDM 

Y Z E E P 
KAPPK 
QDYVZ 
BYHYE 
M W I 0 G 

1 B J M L 
FIBER 
FMTTJ 
D C B D Y 
DRKEZ 



M I I I K 
AZCLJ 
U D I P F 
B I V D I 
G V G F F 
IEBMH 
P P 0 Q U 
3 I Y 3 P 
IMS JO 
I C F E V 
TMKUQ 
E F F F Z 
0 R C B M 
XI QMP 
M X T T T 
FVHPJ 
D K H I R 
R J Y E K 
B F R U C 
Y M W Q V 
MDGIG 
LE1HJ 
QUSZY 
VHDGS 
X X H C X 
P P A T 0 
J E G I K 
G R R H Z 
QBRYF 
XBKFF 
BESIK 
X H Y B D 
KCKCG 
F P P V F 
0 0 



ZRYBB 
E P P F R 
E X M L L 
PBXIV 
F K L Y Y 
Y Z H A U 
S G Y C X 
D 3 B B J 
OXAQS 
XBYMB 
I 0 C A V 
PHBRV 
RRAOB 
SGCTB 
C 0 J V A 
A H Z I T 
QMEDG 
F B E P B 

ccuzz 

CLIP! 
GUBEJ 
P D R X Z 
DBXAB 
J 0 G T C 
YCIXG 
I A N E E 
R T G F F 
QLYXK 
EFQLL 
L X D X T 
XJZJX 
B J U F I 
C V S A G 
D V Z H T 
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1. The message is transcribed in lines of 26 letters, since that 
is the total number of secondary alphabets in the system. The transcribed 
text is shown below: 

1 2 1 4 5 8 7 8 9 10 11 12 13 14 IS 16 17 18 19 20 21 22 23 24 25 28 

1 IwGJJMMMJXEDGCOCFTRPBMIIIKZ 

2 R Y N H B U F R W W W W Y 0 I H F J K 0 K H T T A Z 

3 C 1 J E P P F R W C K 0 0 F F F G E P Q R Y Y I W X 

4 M X U D I P F E X M L L W F K G Y P B B X C H B F Y 

5 I E T X H F B I V D I P H X I V R P W T M G I M P T 

6 E C J B 0 K V B D Q G V G F F F K L Y Y C K B I W X 

7 M X D D I P F F U Y N V S S I H R M H Y Z H A U Q W 

6 G K T I U X Y J J A 0 W Z 0 C F T R P P 0 Q U S G Y 

9 C X V C X U C J L M L L Y E K F F Z V Q J Q S I Y S 

10 PDSBBJUAHYHWLOCXSDQVCYVSIL 

11 IWNJOOMAQSLVYJGTVPQKPKTLHS 

12 R 0 0 N I C F E V H N V W N B N E H A M R C R 0 V S 

13 TXENHPVBTWKUQIOCAVWBRQNFJV 

14 NRVDOPUQRLKQRFFFZPHURVWLXG 
16 SHQWHPJBCNNJ QSOQORCBMRRAOH 

16 RKWUHYYCIWDGSJCTGPGRMIQMPS 

17 GCTHMFGJXEDGCOPTGPWQQVQIWX 
16 TTTCOJVAAABWMXIEOWHDEQUAIN 

19 FKFWHPJAHZITWZKFEXSRUYQIOV 

20 R E R D J V D K H I R Q W E D G E B Y B M L A B J V 

21 TGFFGXYIVGRJYEKFBEPBJOUAHC 

22 U G Z L X I A J K W D V T Y B F R U C C C U Z Z I N 

23 NDFRJFMBHQLXHMHQYYYMWQVCLI 

24 PTWTJYQBYRLITUOUSRCDCVWDGI 
26 GGTJBHJVVPWABUJKHFPFYWVQZQF 

26 LHTWJPDRXZOWUSSGAMHHCWHSWW 

27 LRYQQUSZVDRXANVHKHFUCVVSSS 
26 PLQUPCVVVWDGSJOGTCHDEVQSIJ 

29 PHQJAWFRIZDWXXHCXYCTMGUSES 

30 NDSBBKRLVWR7ZEEPPPAT0IABEE 

31 E E J N R C Z B T B L X P J J K A P P M J E G I K R 

32 TGFFHPVVVYKJEFHQSXJQDYVZGR 

33 rhzqlyxkxazowrrxykygmgzbyn 

34 VHQBRVFEFQLLWZEYLJEROQSOQK 

35 OMW IOGMBKFFLXDXTLW ILPQSEDY 

36 IOEMO IBJMLNNSYKXJZJMLCZBMS 

37 DJWQXTJVLFIRHRXHYBDBJUFIRJ 
36 ICTUUUSKKWBVMFWTTJKCKCGCVS 

39 AGQBCJNEBYRVSSJKSDCBBYFPPV 

40 F D W Z M T B P V T T C G B V T Z K H Q D D R M E Z 

41 0 0 
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k. The Xtest will now be applied to the horizontal rows of tallies 
In the distribution square , in accordance with the theory set forth in 
subpar. 69g. Since this test is purely statistical in character and becaaes 
increasingly reliable as the size of the distributions increases, it is best 
to start by working with the two distributions having the greatest total 
numbers of tallies. Obese are the V and V distributions, with 53 and 52 
occurrences, respectively. The results of three of the 25 possible relative 
displacements of these two distributions are shown below, labeled "First 
test,” "Second test,” and "Third test." For convenience in estimating the 
matching propensities, the X value is expressed in terms of the %I.C. 



Mi 
Mrs 



First test 

0200264800700211 1 1 1064024 

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

26 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 

211530100281760100230212 



fvjw 00400 10 18 0800 14 00 14 601000 18 0028 



7C 0 = 103 X f = 53-5g. = 106 



26 



Sic = 



103 

106 



= 0 97 



Second test 



200264800700211111064024 
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 



Ml 2 

^|18 19 20 21 22 23 24 25 26 
frfw 



1 2 3 4 5 6 6 8 9 10 11 12 13 14 15 10 17 

23021204211530100281760100 

2 0 0 0 0 4 0 16 16 0 0 35 0 0 2 0 0 2 8 1 0 36 0 0 0 0 



ivy =53 

lVw= 52 
2/r/<r=103 



1VV =53 
NV=52 

W«r=122 



Xo = 122 X, = 5L 52 = 106 
26 



Si c =122 =1 

106 



15 



Third test 



*A 

fw { 



1 


0 


2 


0 


0 


2 


6 


4 
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0 


0 


2 


8 


1 


7 


6 


0 


1 


0 


0 


2 


3 


0 


2 


1 


2 
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2 


1 


1 
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3 


0 


2 


0 


0 
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0 


0 


7 


0 


0 


4 


3 


0 


2 


1 


2 


0 24 


8 


0 


2 


20 


r/r/ir= 190 



X 0 = 190 X t = 53 52 = 106 
26 



Sic 



= 19£ 
” 106 



= 1 79 



See subpar 37e on p 
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l. Since the last of the three foregoing teste gives a value some- 
what better than the expected ^I.C. of 1.73, it looks as though the cor- 
rect position of the W distribution with reference to the V distribution 
has been found. In practice, several more tests would be made to insure 
that other close approximations to 1.73 are not found, but these will 
here be omitted. Hie test indicates that the primary cipher component 

12 3 4 

has the letters V and tf in these positions: V . . W, since the correct 
super imposition requires that the 4th cell of the W distribution must be 
placed under the 1st cell of the V distribution (see the last super imposi- 
tion above). 

m. Hie next best distribution with which to proceed Is the F distri- 
bution, with 51 occurrences. Therefore, the F sequence is matched against 
the W and V sequences separately, and then against both W and V sequences 
at their correct super imposition; this procedure serves as a check on the 
correct matching of the W and V sequences. Hie following shows the correct 
relative positions of the three distributions: 



41 

4 ° 



200264800700211111064024 
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 7 
2100639302000211 12042037 



fvfr 1 0 4 0 0 0 36 12 72 0 0 14 0 0 0 2 



X 0 =212 X. 



. 53 51 
26 



= 104 



1 1 1 

%IC = 



2 0 24 8 
212 



0 6 28 



104 



= 2 04 



IV, = 53 

1V,= 51 
VvSr = 212 



[1 1 
F ll 2 



[5 6 7 
/F l0 3 7 



30100281760100230212042 
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 
11210063930200021112042 



Swir 03 35 302000 48 3 63 18 02000602140 16 

X 0 =210 X, = 52 , 5 . 1 .. = 102 ^IC =2 06 

26 102 



Nw = 52 

•7V,= 61 
Zfwfr° 210 



/(v 



J4 0 
r '|l 2 



3004 14 5 15 608004413230 10 6139 
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 IS 19 20 21 22 23 24 25 26 



[8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 
/r \l 12100639302000211 120420 



f(r+w)fr 4 0 6 0 0 0 84 15 35 18 0 16 0 0 0 8 



Xo - 422 X t = 



105 51 
"26 



206 



1 3 2 6 0 40 12 0 

fcT _ 422 „ „ 

^ IC = 206 = 2 05 



1 2 3 4 5 6 T 8 

The test yields the sequence V . . W . . . F 



6 7 
3 7 

9 63 



Wr+r=105 
IV, = 51 

2/ (r+jr>/F*=422 
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n. The process is continued in the foregoing manner until the entire 
primary cipher component has been reconstructed. It is obvious that as the 
work progresses the cryptanalyst is forced to employ smaller and smaller 
distributions, so that statistically the results are apt to become less and 
less certain. But to counterbalance this, there is the fact that the number 
of possible superimpositions becomes progressively smaller as the work pro- 
gresses. For example, at the commencement of operations the number of pos- 
sible points for superimposing a second sequence against the first is 2 5 ; 
after the relative positions of 5 distributions have been ascertained and a 
6th distribution is to be placed in the primary sequence being reconstructed, 
there are 20 possible positions; after the relative positions of 20 distribu- 
tions have been ascertained, there are only 5 possible positions for the 21st 
distribution, and so on. 

o. In the foregoing case the completely reconstructed primary cipher 
component is as follows: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 2324 2526 

VALWHOXFBPYRCQZIGSEHTDJUMK 

Since it vas stated that the problem involves identical primary components, 
both components are new at hand. 3 

£. Of course, it is probable that in practical work the process of 
matching distributions would be Interrupted soon after the positions of only 
a few letters in the primary canqponent had been ascertained. For by trying 
partially reconstructed sequences on the cipher text, the skeletons of some 
words would begin to show. By filling in these skeletons with the words 
suggested by them, the process of reconstructing the components is much fa- 
cilitated and hastened. 



£. The components having been reconstructed, only a moment or two is 
necessary to ascertain their initial position in enciphering the message. 

It is only necessary to juxtapose the two components so as to give "good" 
values for any one of the vertical distributions of Fig. 75 • This then gives 
the juxtaposition of the components for that column, and the rest follows 
very easily, for the plain text may now be obtained by direct use of the com- 
ponents. The decipherment of the beginning of the cipher text is as follows: 



1 3 3 4 S 8 7 8 9 10 11 12 13 14 15 10 17 18 19 30 31 23 S3 34 38 38 

1 IWGJJMMMJXEDGCOCFTRPBMIIIKZ 
WITHTHEIMPROVEMEHTSIHTHEAI 

2 R Y H H B U F R W W W W Y 0 I H F J K 0 K H T T A Z 

RPLANEANDTHEMEANSOFCOMMUNI 



3 



C L J E P P 
CATIOJ 



3 If we did not know in advance that identical primary components were involved this fact could have been 
deduced from a study of the frequency distributions in Fig 75 Note that the distribution for col 1 may be 
fitted to the normal, this shows that we have identical components running in the same direction and that the 
setting for col 1 is A p = A c 
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r. The student should clearly understand the real nature of the 
Batching process employed to such good advantage in this problem. In 
practically all the previous cases frequency distributions were made of 
cipher letters occurring in a cryptogram, and the tallies in those dis- 
tributions represented the actual occurrences of cipher letters. Fur- 
thermore, vhen these distributions vere compared or matched, vhat were 
being compared vere actually cipher alphabets. That is, the text vas 
arranged in a certain vay, so that letters belonging to the same column 
and the frequency distribution for a specific cipher alphabet vas made 
by tabulating the letters in that column. Then if any distributions 
vere to be compared, usually the entire distribution applicable to one 
cipher alphabet vas compared vith the entire distribution applying to 
another cipher alphabet. But in the problem just completed, vhat vere 
compared in reality vere not frequency distributions applying to the 
columns of the cipher text as transcribed in subpar. 69e, but graphic 
representations of the variations in the frequencies of " plaintext letters 
falling in Identical sequences, the identities of these plaintext letters 
being unknown for the moment . Only after the reconstruction has been 
completed do their identities become known, vhen the plain text of the 
cryptogram is established. 

70. Solution by the probable vord method. — a. The foregoing method 
of solution is, of course, almost entirely statistical in nature. There 
is, however, another method of attack vhich should be brought to notice 
because in same cases the statistical method, involving the study of rela- 
tively large distributions, may not be feasible for lack of sufficient 
text. Yet in these cases there may be sufficient data in the respective 
alphabets to permit of some assumptions of values of cipher letters, or 
there may be good grounds for applying the probable vord method. The 
present paragraph vill therefore deal vith a method of solving progressive 
alphabet cipher systems vhich is based upon the application of the princi- 
ples of indirect symmetry to certain phenomena arising from the mechanics 
of the progressive alphabet encipherment method itself. 

b. Take the tvo sequences below and encipher the phrase FIRST BAT- 
TALION by the progressive alphabet method, sliding the cipher component to 
the left one interval after each encipherment. 

Components 

Plain HYDRAULICBEFGJKMNOPQSTVWXZ 

Cipher.... FBPYRCQZIGSEHTDJUMKVALWNOX 

Message 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 

Plain FIRSTBATTALION 

Cipher. ... EICHXDSPYTUKYY 
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c. Certain letters are repeated in both plain text and cipher text. 
Consider the former. There are two I's, three T's, and two A's. Their 
encipherments are isolated below, for convenience in study. 



F 


IRS 


TBATTALION 


1 


2 


3 4 


5 6 7 8 9 10 11 12 13 14 




I 


• e 




Cipher • • • • • 


I 


• • 






e 


• • 


TeeTTeeeee 


Cipher • • e # • 


• 


• e 


XsaFYiiiii 




• 


s e 


seA««A*eee 


Cipher .... . 


e 


• • 





( 1 ) 

( 2 ) 

(3) 

W 

(5) 

( 6 ) 



The two I's in line (l) are 10 letters apart; reference to the cipher com- 
ponent will show that the interval between the cipher equivalent of the first 
Ip (which happens to be I<») and the second Ip (which is Kc) is 10. Consider- 
ation of the mechanics of the enciphering system soon shows why this is so: 
since the cipher component is displaced one step with each encipherment, two 
Identical letters n intervals apart in the plain text must yield cipher 
equivalents which core n intervals apart in the cipher component. Examination 
of the data in lines (3) and (4), (5) and (6) will confirm this finding. Con- 
sequently, it would appear that in such a system the successful application 
of the probable word method of attack, coupled with indirect symnetry, can 
quickly lead to the reconstruction of the cipher component. 



d. Now consider the repeated cipher letters in the example under sub- 
par. b. There happens to be only two cases of repetition, both Involving 
Y's. ""Thus: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 

..T...0N 

Y...YY 



Reference to the plain component will show that the plaintext letters repre- 
sented by the three Y's appear In the order NO. . . T, that is, reversed 
with respect to their order in the plain text. But the intervals between 
these letters is correct. Again a consideration of the mechanics of the 
enciphering system shows why this is so: since the cipher component is dis- 

placed one step with each encipherment, two Identical letters n intervals 
apart in the cipher text must represent plaintext letters which are n inter- 
vals apart in the plain component. In the present case the direction in 
which these letters run in the plain component is opposite to that in which 
the cipher component is displaced. That is, if the cipher component is dis- 
placed toward the left, the values obtained from a study of repeated plain- 
text letters give letters which coincide in sequence (interval and direction) 
with the same letters in the cipher component; the values obtained from a 
study of repeated ciphertext letters give letters the order of which must be 
reversed in order to make these letters coincide in sequence (interval and 
direction) with the same letters In the plain component. If the cipher 
component is displaced toward the right, this relationship is merely re- 
versed: the values obtained from a study of the repeated plaintext letters 

must be reversed in their order when placing them in the cipher component; 
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those yielded by a study of the repeated ciphertext letters are inserted 
in the plain component in their original order. 

e. Of course, if the primary components are identical sequences the 
data from the two sources referred to in subpars. c and d need not be kept 
separate but can be combined and made to yield the~primary component very 
quickly. 

f. With the foregoing principles aB background, and given the first 
few groups of an Intercepted message, which is assumed to begin with COM- 
MANDING GENERAL FIRST ARMY (probable word method of attack), the data 
yielded by this assumed plain text are shown in Fig. 76. 

IKMKI LIDOL WLPNM VWPXW DUFFT FNIIG 

X G A M X CADUV AZV1S YNUNL..... 

X 2 8 4 8 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 28 

Assumed plain text COMMAHDXHGGENERALFIRSTARMY 
Cipher IKMKILIDOLWLPNMVWPXWDUFFTF 
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Figure 7b. 



Analysis of the data afforded by Fig. 7b, in conjunction with the principles 
of indirect symmetry, yields the following partial components : 



1 2 3 4 s g 7 8 9 10 11 12 13 14 15 18 17 18 19 20 21 22 23 24 26 



Cipher 



. .MKV.LWNO.F.P I....T. 

D X 




Setting the two partial components into Juxtaposition so that Cp ■ I c (first 
encipherment) the dth value, Ip - D c , gives the position of D in the cipher 
component and permits the addition of X to it, these being two letters which 
until now could not be placed into position in the cipher component. With 
these two partial sequences it becomes possible now to decipher many other 
letters in the message, gaps being filled in from the context. For example, 
the first few letters after ARM! decipher as follows: 

1 2 3 4 5 6 7 8 9 10 II 12 

Cipher. ... HIIGXGAMXCAD 

Plain. .... . I L . « . .SO. *R 



The word after ARM! is probably Will.. This leads to the insertion of the 
letter W in the plain component and G in the cipher component. In a short 
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time both components can be completely established. 

g. In passing, it may be veil to note that in the illustrative mas- 
sage in subpar. 69h the very frequent occurrence of tripled letters (MMM, 
WWW, FPF, etc.) indicates the presence of a frequently used short word, 
a frequently used ending, or the like, the letters of which are sequent 
in the plain component. An astute cryptanalyst vho has noted the fre- 
quency of occurrence of such triplets could assume the value THE for them, 
go through the entire text replacing all triplets by THE, and then, by 
applying the principles of indirect symmetry, build up the plain component 
in a short time. With that much as a start, solution of the entire mes- 
sage would be considerably simplified. 

71. Solution by means of isomorphs.— a. One of the most powerful 
attacks in cryptanalytlcs involves the exploitation of isomorphs; i.e., 
ciphertext sequences vhlch exhibit an idiomorphism identical vith that of 
another ciphertext sequence; this method finds applicability in many va- 
rieties of manual cipher systems, and it also takes on a very important 
aspect in the solution of many machine cipher systems. In progressive 
alphabet ciphers, the presence of Isomorphs, if they are of fair length 
and proper composition, might enable the cryptanalyst to derive the com- 
plete primary cipher component directly and thus reach a quick and easy 
solution of a problem; in any case, isomorphs will enable the partial re- 
construction of the cipher component, facilitating further analysis and 
solution. 

b. Isomorphic sequences in the cipher text of progressive alphabet 
systems may be brought about by Identical plaintext beginnings 4 of a pair 
of messages, by identical endings 5 , by a stagger situation, or by a latent 
repetition occurring within a message or between a pair of messages. Iso- 
morphism may be discovered by examining all pronounced idiomorphlc patterns 
in the cipher text and comparing patterns so disclosed for exact corres- 
pondences of repeated letters, i.e., isomorphs. For instance, the two iso- 
morphic ciphertext sequences below may be isolated by searching for all the 

(1) CVCHAUHYHHITNLC 

(2) EXEPLIDRDDBWPCE 

AA patterns 6 in the cipher texts under examination, and inspecting the let- 
ters which precede and follow these AA patterns for further evidences of 



4 These beginnings need not necessarily be stereotyped beginnings The composition of the plain text is 
unimportant, the only requisite factor is that the beginnings consist of identical plain text 

5 This situation is, of course often brought abort by identical signatures at the ends of messages 

g 

In searching for isomorphs, it might be also necessary to examine all A -A patterns and then A- -A 
patterns if the AA patterns do not bear fruit 
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apparent isomorphism. Obviously, not all sequences surrounding AA patterns 
vill be causal lsomorphs; this is especially true in the case of short iso- 
morphic sequences, Just as short repetitions in cipher text may occur by 
chance and not be due to causal factors. But if an isomorph can be extended 
sufficiently (i.e., if further isomorphic patterns about the basic AA pat- 
terns are noticed), then the lsomorphs may be considered valid, and the 
delineation of the lsomorphs to the left and right, insofar as discernible, 
may be established. 



c. As an example of a solution by means of isomorphs, 
the following beginnings of three messages: 

Message "A" 


let us consider 


VHPE 
H S F V 0 


S M X W I 
J R R T D... 


PUCWR STGUC 

> e e 

Message "B" 


R M L J J 


T U Q R E 


R W W Z I 
S T T D B 


Y V U A K 
GIOCI.., 


ZGMAE YDQGM 

> • e 

Message n C n 


E V J S S 


D G W G Z 


U Z Z Y B 
B R A X C 


R X I L H 
VYEE P... 


YKOLG RATKO 

1 • e 


H Z B T A 


G F P M F 



It is noted that Messages "A" and "B" are isomorphic from their beginnings 
to their 27th letters, and that Message "C" is Isomorphic with the other 
two from its beginning to the 20th letter. 7 The isomorphic portions are 
now superimposed, as is shown in the diagram below: 

"A": VBNPHSMXWIFUCUBSTGUCRMLJJ1U 
"B": RWWZiyVUAKZGMAETDQGMEVJSSDG 

"C": UZZYBRXILNYKOLGRATKO 

Chains from the foregoing diagram are derived, as follows: 



tv A l, - n B fV 


"A"-"C" 


n S n mt n C n 


CMVRE 


VUK 


WZYRUIB 


HWA 


MXUJZ 


VX 


PZ 


PI 


DAL 


ELK 


SRGTA 


EGKH 


LJSY 


WL 


MO 


XUGQ 


00 


QT 


05) 







Using the principles of Indirect symm etry , an eq uiva le nt pr imary cipher 
component is recovered as follows: □WREOXUGQHIKTDBHWAFPZLJSy. Decimation 



n 

The isomorphism manifested actually begins with the second letters of the messages, it cannot be 
proved at this point that it includes the first letters, but the absence of contradictory evidence in isomorphs 
of this length plus the fact that the isomorphs are at the beginning of the messages, makes this a safe 
assumption 
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of this sequence at an interval of -11 brings out the original keyword- 
mixed sequence, based on HYDRAULIC. 

d. With the cipher component now at hand, the text of any one of the 
messages may now be reduced to monoalphabetlc terms, if we can assume the 
correct motion of the cipher component; 8 in other words, a known motion 
makes conversion to monoalphabetlc terms possible, 'flaking the fragment of 
Message "A" as an example, and assuming that the cipher component is slid 
to the right after each encipherment, we have the following conversion (in 
terms of an arbitrary A-Z sequence for the plain component) and its accom- 
panying uniliteral frequency distribution: 

C: VHHPHSMXWIPUCWRSTGUCRMLJJT 
F: WRSVEZVFFQCQUKRJLDXBXKCKLU 

C: UQREHSFVOJRRTD 

P: FUFHEZRDZWNOHP 

_ --5 _= _ _ = _ = _ = _ _ _ = I.C. * 0.90 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

This is certainly not satisfactory. Assuming that the cipher component is 
slid to the left, we have the following: 

C: VHHPHSMXWIPUCWRSTGUCRMLJJT 
P: WPOPWPJRPYIUWKPFFVHPJUKQPW 

C: UQREHSFVOJRRTD 

P: FSBHWPFP JETS JP 

$ 

_ = _ _ s = ■ 2.33 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Obviously this is the correct case. After solution of the monoalphabet, 
which is facilitated in this case by the idloaorphic patterns now revealed, 
it is found that the recovered plain component is the same as the cipher 
component, except that it runs in the reverse direction. 

e. It should be clear why isologous sequences in progressive alphabet 
systems, unlike Isologous sequences in other types of periodic ciphers, pro- 
duce isomorphs which may be chained without regard to the particular alpha- 
bets Involved, and also why the conversion process is not affected by the 
identity of the particular alphabets. In the usual type of repeating-key 
cipher, the selection of the alphabets used is determined by a key word 



o 

This very important consideration forms the basis of solution of cryptograms produced by many types of 
cipher devices and cipher machines This principle will be elaborated upon m much greater detail in 
Military Cryptanalytics, Part III 
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which is used for this purpose; the letters of the key hear no constant 
displacement -relationship to each other. However , in the case of a pro- 
gressive alphabet cipher the successive elements of the key, 26 in number, 
are a constant Interval apart from each other as measured on the cipher 
component; this accounts for the fact that, if one encipherment of a 
plaintext passage produces an idiomorphic ciphertext sequence, the remaining 
25 other possible encipherments will also produce idiomorphic cipher texts 
which will all be isomorphic to one another. 

72« Solution by superimposltlon.— a. Bie discussion in this chapter 
thus far has, except for special solutions, been limited to cases wherein 
there is available a long message in a progressive alphabet system. Suppose 
that in the traffic there are no long messages, what then? If a number of 
short messages are available, then there should be a way to superimpose the 
messages properly, that is, put them in depth, even if no two messages begin 
with the same initial key latter, i.e., start at the same point in the key 
sequence. 

b. There are three principal means for superimposing messages in pro- 
gressive alphabet systems. 9 These are: (l) superimposition by means of 

known indicators 10 ; (2) superimposition by ciphertext repetitions; and (3) 
superimposltlon by a comparison of columnar frequency distributions. The 
first of these methods is rather obvious: it goes without saylzig that if 

the enemy were still using a compromised or recovered Indicator system, then 
of course all messages could be put in depth without any analysis whatsoever. 
Hie second method, that of superimposltlon by repetitions, is also quite 
obvious: since long repetitions (i.e., long for a given sample size) have 

a high probability of being causal, then the alignment of messages to make 
the polygraphic repetitions fall into identical columns of the width of the 
period will result in the correct superimposltlon of the messages. The third 
method, that of comparison of the columnar frequency distributions, will be 
discussed in detail below. 

c. Let us consider a long message in a progressive alphabet cipher, 
such as that given in subpar. 6<?i, and let us also consider its columnar fre- 
quency distributions given in Fig. 75. If we had at hand another long mes- 
sage, which however began at a point in the keying sequence 5 places to the 
right of the first message, it is clear that col. 1 of the second message 
would not resemble col. 1 of the first message. Nevertheless, col. 1 of the 
second message would bear a close resemblance to col. 6 of the first, and 
col. 2 of the second message would be very similar to col. 7 of the first, 
and so on. If our two messages had about 40 tallies per distribution (as 

in the example) , there would be little trouble in finding the correct 



9 These means to be described axe also applicable for the superimposltlon of messages in other types 
of repeating- key systems 

10 Indicators play an important role m cryptography An indicator is a symbol (consisting of a letter, 

a group of letters, a figure, or a group of figures) which indicates the specific key used under the general 
cryptosystem or it may indicate which one of a number of general systems has been used or it may indi- 
cate both. 
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matching of the columns, since this could be done easily by ocular In* 
spec t ion. If however we had at hand a pair of short messages (say between 
100 and 200 letters each) , then mere ocular inspection would be of no 
avail, and recourse must be had to statistical methods to find the proper 
superlmposition. 

d. Let us assume that we have for study a set of short messages 
intercepted on a particular day on a naval circuit known to be passing 
traffic in progressive alphabet systems. It is further known that the 
primary components are changed daily; therefore the traffic of one day 
is expected to be homogeneous with respect to the primary components in- 
volved. Two of the longest messages are given below, of lengths 190 and 
170 letters, respectively: 



Message "A" 



HFDCS 


WTQOO 


YCFXF 


llWLCrP 


ULRIU 


RHFDQ 


HCXPS 


SNIPG 


HXUVL 


CUDAV 


WAYHK 


ZHKXS 


BIFDM 


Bum 


FBLWT 


RDAAH 


YQSSJ 


VSODY 


EFFBI 


UGXLB 


IAYRH 


KHMHM 


VSUAS 


CKSKM 


LAFBL 


OICZK 


KEZVH 


JSAGT 


ZKEBX 


VERGF 


ZIAUJ 


ZSJFT 


WSOQF 


GQOKZ 


WBREC 


BIYCD 


VUYXD 


MKZKT 














Message "B" 










KVCKV 


SUBOX 


SYFGV 


ZWTQO 


OEAQP 


ZKBJV 


SPLEH 


WDKJW 


WHHLT 


FEOYD 


PLGRC 


UATVR 


RSLAH 


OPWYL 


WWTBS 


QIFFA 


DBQSA 


IURYA 




BXXAE 


OFNFF 


Turner. 


IVSUA 


YGEDI 


bsvmp 


sqMLi 


GEGID 


BZEMA 


YFHZR 


CZTGG 


HDAKP 


NMKOB 


SBLPH 


AYABX 















e. Since the period of the messages is 2b, the messages are written 
out on this width. What we will now do is align the messages in flush depth 
and perform a % test of the corresponding columns, arriving at a value of X 
(or a %I.C.) for that particular alignment. 11 After this test is completed, 
we will slide Message "B" over one position with respect to Message "A", and 
perform the test again; and so on for the 2b possible alignments. In order 
to facilitate the comparison of the texts, we will write out Message "B" in 
doubled length, as is shown in Fig. 77 below (for the first comparison); 
the X 0 wslues are derived for each column and are Indicated under the re- 
spective columns. 



11 This procedure is somewhat akin to that demonstrated in subpar 18e m connection with the use of 
the 6 test to determine the number of alphabets of a relatively short cryptogram of a lengthy period See 
also footnote 11 on p 39 
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14 15 16 17 18 

XFHHL 

G H X U 
B N K K 
FF8I 
FKML 
B X V E 
ZVBR 



19 20 21 2223 2425 26 



G P 
L C 



RIUB 



F B L V 
GXLB 



F B 
G F 
C E 



A V W 
T R D 
I A Y 
I C Z 
A U J 
C D V 



A 

A 

R 

K 

Z 

U 



WDKJWWHHLTPEOYDPL 
SLAHOPWYLWWTRSQIF 
RYADZEZSBXXAEOPHF 
UAYGEDIHSVMPSQMLI 
AYPHZRCZTGGHDAKPB 
A Y A H X 



04101 232024101 ^"X=50 



Figure 77* 



f . In the foregoing comparison, we note that the observed value of X 
for aTl the columns Is 30. We will now compute the expected values of X m 
and X r with which to compare the X 0 . Since in Fig. 77 ve have 8 columns 
of 8x7 letters, 6 columns of 7x7 letters, and 12 columns of 7x6 letters, the 
total number of comparisons is * 1246. Thus X B » 

.0667(1246) * 83.11, and X a s 47.92. The %I.C. * JpL— * 1.04, so 

So t" e92 

instead of arching his eyebrows the cryptanalyst will merely shrug his 
shoulders and go on to the next test. 
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£. For the second test, we will move Message "B" one column to the 
right so that the first letter of Message "B" Is under the second letter 
of Message "A", as shown below, and the X values are determined as before. 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 2223 242526 

HFDCSWTQOOYCPXFHWLGPULRIUF 
HFDQHCXPSSHIPGHXUVLCUDAVW A 
YHKZHKXSBIPDMBNKKIFBLWTRDA 
AirqSSJTSOHEFFBIDGXLBIAIB 
HRNMHMVSUASCMFKMLAFBLOICZK 
KEZVHJSAGTZHEBXVERGFZIAUJZ 
SJFTVSOQFGQOKZWBRECEIYCDVU 
YXDMKZKT 



1 2 3 24 2526 1 2345678 9 10 11 12 13 1415 16 17 18 19 20 2122 2324 2526 



— ] 


, 


K V C R V F U B 0 X S Y F G V Z W T Q 0 0 E A Q P Z 


K V Ci 




fQPZKBJWZPLEEWDKJWWHHLTPEOYDPL 


kbj; 




'DPLGRCUAYVRRSLAH0PWYLHWTRSQ1F 


GRCj 


1 


fQlFFADBQSAIURYADZEZSBXXAEOPNF 


FAD- 




PHFFUKIELIVSUAYGEDIHSVMPSQMLI 


FUK 




MLIGEGIDBZEMAYPHZRCZTGGBDAKPH 


G E G 
HKG j 




•KPHMKGBSBLPHAYAHX 
-! 



041 2131 21 3143321202101 1210 iX=*2 

Figure 78 , 



For this case, the number of cosparisons is 7(8*7)+l(8*6)+7(7 , 7) + 11(7*6) * 
1245, thus Xm ■ .0667(1245) ■ 83.04, and "X r = i|j£ - 47 . 88 . Since X Q = 
42, the £l.C. in this case is * 0.88, which means another shrug. 
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jJ_. Grasping at straws , the cryptanalyst tries to save the situation 
with the 4 test. For the 15th superiaposition, he obtains the following: 

o 8 3^ 

. 2(l5‘l4)tl8(lVl3)+6(l3-12) . top. . 17 s 

*p • .0667(1*632) - 309 
Sl.C. " B 1 * 9 ^ 

Fine. How for the 16th superiaposition: 

4> 0 8 2 98 

* , 3 (15 » 14) +16 (lj»« 13 )+7 (13 • 12) - » 17 * 

r 26 26 

*p ■ .0667(1*631*) * 309 

^ l.C. ■ 296 s 1.67 



What did not arch the eyebrows, shrug the shoulders, or gladden the heart, 
now gives a sinking feeling in the pit of the stomach. 

k. Impaled on the horns of a dllema, 14 the cryptanalyst is forced to 
try both hypotheses; at least there are only two — it could have been worse. 
The 15th superiaposition is actually the correct alignment of the messages, 
so if he trusts the high %I.C. , the cryptanalyst will be right the first 
time. The authors hasten to assure the reader that, in spite of dark sus- 
picions to the contrary, the accidental pentagraphlc repetition was not 
manipulated or forced, but really did happen accidentally. What this ex- 
perience teaches us is that the %I.C. is more to be trusted than the &I.C. 
in matching distributions 15 , and that, evidently, in samples of this size 
the probability of a very high %I.C. being reached in an incorrect case is 



13 The procedure here is that demonstrated in subnar 18e 

14 Of, however, a small order of magnitude 

15 In Statistica l Methods m Cryptana lysis, par 22, Dr Kullback demonstrates the fact that the Xtest is 
preferable to the $ test insofar as matching distributions is concerned He also shows (p 49) that if two mono 
alphabetic distributions have been merged, the expected value of is given by the formula = 0667(N-1) - 

05641^2, where N = Nj +N 2 If the two distributions are of equ al size (1 e , if Nj = N 2 ), the expected %LC 

of two merged non-related monoalphabetic distributions will usually be in the vicinity of L? 3 ~L.9£. = 1 37 

2 

Thus, when Message 'A' and Message "B' are incorrectly superimposed in flush depth as m subpar e_, the 
average Sl.C of the merged distributions if found to be 1 42, which is just about what is expected 
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less than the probability of an accidental pentagraphlc repetition. In 
passing, it might be veil to heap in mind the following excerpt from 
Kullback: 16 

"It is not very often that statistical analysis alone will enable the cryptanalyst to arrive at the solu- 
tion of a cryptogram Statistical analysis will, however, enable the cryptanalyst to evaluate the desira- 
bility of pursuing certain procedures and will indicate the most likely order in which to tr y various possible 
steps in solution " — — — — _____ “ - _____ 



While ve're at it, it might not hurt to keep in mind the following quotation 
from an unidentified author: 

"There are three kinds of lies lies, damned lies, and statistics " 

1. It vas stated in subpar. d that the tvo messages under discussion 
were from a set of short messages; the foregoing procedures vould be con* 
tlnued, adding more messages to the already established depth, until a suf- 
ficient number of messages were put in depth to permit of solution by means 
of the % test as treated in par. 69 . These first two messages might by 
themselves probably be unsolvable; for the student vho is interested in 
solving them, it will be added that the signature TOMLINSON is present in 
Message "B". 

73. Additional remarks.- - a. As has already been Indicated in subpar. 
67 a, the number of different alphabets in progressive alphabet systems is 
notT necessarily confined to 26. It is possible to have N * 25, 27, 30, 32, 
36, ... 100; obviously, vhere N is greater than 26, the cipher characters 
cannot be restricted merely to the 26 letters of the alphabet, but must 
either include additional symbols, or else the cipher text must be repre- 
sented by digit groups such as dinames. If a Baudot system incorporated a 
progressive alphabet principle, then of course the components vould involve 
the 32 characters of the Baudot alphabet. 

b. The principles elucidated in this chapter may, of course, also be 
applied to cases of progressive alphabet systems in which the progression 
is by regular intervals greater than 1, and, vith necessary modifications, 
to cases in which the progression is not regular but follows a specific 
pattern, such as the successive displacements 1-2 -3 -4-5, 1-2 -3 -4-5, ..., 
or 2-5-1 -3-1 -4-2-3, 2-5-1 -3-1 -4-2-3, and so on. 17 The latter types of 
progression are encountered in certain mechanical cipher devices, the 
study of which will be reserved for the next text. 

c. There has been a liberal sprinkling of elementary cryptomathematics 
as applied to specific situations in the text thus far. This topic will be 
treated in full detail in Military Cryptanalytics , Part III . In the mean- 



16 Ibid , p 1 

17 

Cases may be encountered in which the selection of alphabets is controlled by a 26 -element key 
comprised by a keyword-mixed sequence as a mnemonic device. 
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while, the student who Is interested in pursuing the subject further 
will profit if he consults the works listed below and gleans from them 
what he can, depending upon his mathematical background: 

S. Kullback, Statistical Methods in Cryptanalysis. (Revised. Edition ), 
Washington, 193&. (Unclassified) 

H. Campaigne, The Index of Coincidence, Washington, 1955* 
(Confidential/Modified) 

H. Campaigns, Statistics for Cryptology, Washington, 1951* 

( Confidential) 

For a first book on statistics, the following is highly recommended: 

S. S. Wilks, Elementary Statistical Analysis, Princeton University 
Press, I 9 LB. 



Three valuable tables exceedingly useful for cryptanalytic work are those 
cited below. These documents are prefaced with an introduction which shows 
how the tables are used in typical cryptanalytic applications. 






tanalyat *8 Manual, Section 5-1, Table Of the Poisson Distribution 
Individual and Cumulative Terms) , Washington, 1955. (Unclassified) 



0 ^ 



tanalyat 1 s Manual , Section 5-3# Expected Number of x-fold Repetitions 
Binomial Distribution) , Washington, 1950* (Unclassified) 



Cryptanalyst '8 Manual, Section 5-k, Abridged Binomial Tables Applicable 
to Single-Character Cryptanalytic Distributions (P • 1/32, 1/30, l/2t>, 
1/25, 1/10), Washington, 195». (Unclassified) 
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